Integrations. SSO and roster sync
First Six deliberately has a small integration footprint. To go live, two things connect to your systems: how people sign in, and how the student roster gets in. Both are covered here; the step-by-step is in the developer docs.
Single sign-on
Students and staff sign in with your existing identity provider using standard OpenID Connect. The practical implications for you:
- No new passwords. People use the university login they already have, with whatever MFA you enforce. First Six never sees a password.
- You stay in control of access. Because sign-in goes through your IdP, disabling someone there stops them signing in to First Six again. Any live session runs out within its window (8 hours of staff inactivity, 30 days for students) or can be revoked immediately from the console's Team page.
- SSO is the only way in. There is no password path and no email-link fallback, so your IdP's policies are always the ones that apply.
The technical flow (OIDC with PKCE, token verification) is in the OIDC flow.
A successful SSO sign-in attaches to a student or staff record that already exists from the roster. It cannot invent an account. That's a safety property: only people on your synced roster can get in. It also means the roster has to be connected first.
Roster sync
Your student records system feeds the roster (who's enrolled, in which program, at which campus) so the right students get the right experience. What matters at the decision level:
- You push to us, on your schedule. A secure endpoint receives roster data; you control when it runs.
- Safe to re-run. Sync is idempotent. Running it again reconciles rather than duplicating. And it's rate-limited and size-capped.
- Minimal fields. It carries what's needed to place a student: name, email, a student identifier, program, campus, and a first-in-family flag.
The field-level detail and security are in the SIS sync endpoint.
The order of go-live
Because SSO links to existing people, the sequence is: stand up the tenant and brand, sync the roster, then enable SSO. The full sequence is in onboarding, step by step.
Common questions
Which identity providers do you support?
Standard OpenID Connect providers, including Microsoft Entra ID. If your IdP speaks OIDC, it fits. See the OIDC flow.
Do you pull data out of our SIS automatically?
No. Your side pushes roster data to the sync endpoint on your schedule. You control the flow and the cadence.
Are there other integrations to worry about?
SSO and roster sync are the two that matter for go-live. Everything else is optional and additive. You don't need any of it to launch. If you want it, First Six can also mirror help requests into your existing help desk as tickets (email-to-case), send signed outbound webhooks to your own systems, route crisis alerts to Slack or Teams, and pull your events calendar in.
Next steps
Related
The fastest answer is usually one question away.