OneLogin SSO
Connect OneLogin SSO to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect OneLogin SSO to collect identity & sso evidence with automated compliance tests, switched on per workspace.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| OneLogin SSO's guide | developers.onelogin.com |
Connect with an API token
-
In OneLogin SSO:
- Sign in to OneLogin as an account owner or administrator.
- Go to Developers › API Credentials and click New Credential.
- Enter a name (for example Safeguard), select Read All, and click Save. (Optional, broader than read-only: Manage Users, only if you want the checks that need it.)
- Copy the Client ID and Client Secret that are displayed.
Where to find the other values:
- Client ID: Shown after saving the credential; existing credentials are listed under Developers › API Credentials.
- Subdomain: The part before .onelogin.com in your OneLogin address (https://<subdomain>.onelogin.com).
Read All allows GET calls across all API resources; Manage Users adds write access to users and groups and is optional. The fetched page's wording on whether the client secret can be viewed again after creation was ambiguous, so copy it at creation.
Source: developers.onelogin.com, checked 2026-10-07.
The permissions Safeguard needs:
Read All. Optional, broader than read-only: Manage users. Without it, the checks that need it show an error naming it. Safeguard only reads with it. -
On Compliance › Connectors, open OneLogin SSO, click Connect, choose API token and fill in:
Field What to enter Client ID Required. Client secret Required. Stored encrypted and never shown again. Subdomain Required. The part before .onelogin.com in your address. -
Click Connect with token.
Frameworks
Safeguard's automated tests read OneLogin SSO and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3 | 7 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.5 | 7 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(a)(1), 164.312(d) | 7 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.2 | 7 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-03, PR.AA-05 | 7 |
These tests are switched on per workspace by the Safeguard team.
OneLogin connect to the same provider as OneLogin SSO, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks