DISCLAIMER: Some content in this article outlines how to use functionalities that will be publicly released to all clients at the end of March 2023. If you see differences between this article and your platform, check back at that time for updated content.

PLEASE NOTE: In order to improve the security of your platform, as of November 1, 2021, Docebo has discontinued the support of second-level domains. 

Introduction

Docebo's Extended Enterprise App is a useful tool that allows you to rebrand your platform to show customized branding elements for each organizational chart node.

To activate this app, please contact your Sales account.

Use Case Scenarios

The Extended Enterprise app can serve different scenarios, one of which is self-registration. For example, the branch that is assigned to an Extended Enterprise has sub-branches nested under it.  Users can self-register and when doing so, they need to select the sub-branch they are associated with and be placed into that sub-branch rather than the Extended Enterprise branch. Users will be required to enter a branch code or to choose a branch from a dropdown of available branches to identify their branch placement.

Configuring Global Settings for Your Extended Enterprise

Start your configuration by managing the global settings of the app. Log into your platform as the Superadmin, then select the gear icon from the top right corner of the page to access the Admin Menu. Find the Extended Enterprise section, then press the Settings subitem.

On the Settings page, select the option to enable login restrictions for the users of your Extended Enterprise. This option can only be selecte globally (for all of the Extended Enterprise clients), it is not possible to set this restriction at domain level.

When this option is enabled, users will be able to log in only to the domain they belong to. If a user attempts to access an Extended Enterprise platform to which he or she is not assigned, he or she will receive an error message and will not be allowed to log in.

When this option is NOT enabled as well as when already logged in to a domain, if users attempt to access a domain of the Extended Enterprise to which they are not assigned, a domain selection page will be displayed for the selection of a domain to which they have access. The page lists all of the platforms that the user has permission to access so that he or she just needs to click in the platform’s name and log into that platform.

Superadmins are always allowed to access any Extended Enterprise platform, so the domain selection page will not be displayed to them when logging into the platform.

Please note that all users are allowed to access the main domain, as every user is associated with the root branch.

Creating Clients for Your Extended Enterprise

You can create clients for your Extended Enterprise by accessing the main Extended Enterprise management page. Reach the Admin Menu, then press the Manage item in the Extended Enterprise section. Press the New Client button at the top of the page. In the pop-up box, assign a name to the client, and choose if you want to assign a new domain, or use a subdomain from your platform. You can also choose to create a subfolder instead, if desired. Please note that your Docebo platform only takes third-level domains (since November 1st, 2021 second-level domains are no longer being supported). An example of a third-level domain is subdomain.yourcompany.com or www.yourcompany.com. Here, you will only need to confirm the CNAME, as yourcompany.docebosaas.com. 

Any level beyond this will not work. Keep in mind that any subdomain you want to use must be registered with an Internet Service Provider (ISP). We strongly suggest not using 4th-level domains as you may experience problems with HTTPS certificates.

Press Next to proceed. Now assign a branch of your organizational chart to this customer, then press Next. Please note that you can only assign one Extended Enterprise client to a user branch in your platform. Multiple Extended Enterprise clients cannot be added to a single branch. If you try to add an Extended Enterprise client to a branch that already has an assigned client, you will receive an error message. Now, users will be able to see a different color scheme, URL, logo, homepage image, and course player based on their organizational chart node.

Please note: When you are selecting the branch of your organization chart to associate with specifc domain, please note that in order to make it easier and faster to select branches, you will see a text input field to type in branch names rather than a list of branches to select if you have more than 1,000 branches in your platform.

Users of this branch will have their own URL to access the platform. When you create your Docebo installation, you will first choose a default domain name for your new platform (e.g. elearningbox.com), but the intention with this app is that by using custom URLs, you can assign additional domain names to the same Docebo installation.

Managing the Client Branding and Look

To manage the client settings and preferences, find the client in the list of clients on the bottom half of the main Extended Enterprise page, then click on the gears icon in the client's row. At the top of the client's settings page, click the Configure Branding and Look button to access the corresponding menu for the selected client and to configure its look and feel. 

The Configure Branding and Look page will open in a new tab, so make sure your browser is configured in order to allow Docebo to open new tabs. Configure the branding and look as described in the dedicated article of the Knowledge Base, and press Save Changes to confirm the update and close the tab, going back to the client settings page. 

Click on the pen and paper icon next to the Configure Branding and Look button to change the client name and the client type. 

Docebo White Label Tab

For those using Docebo's White Label, you can apply White Label settings to specific Extended Enterprise clients, or adjust various parts of the theme in this tab. Please note that the options in this tab change depending on which theme you've selected for the client, so you should refer to the corresponding articles linked in this section for more information about the options in this area.

HTTPS Tab

If you have activated the HTTPS app, you can upload and install your SSL certificate for each domain configured via this app. When finished, press Save.

Course Catalog Tab

In this tab, you can apply specific settings related to internal or external course catalogs. In order to enable the customization of this area, select the option Enable custom settings for this client, otherwise, users assigned to this folder will see the standard course catalog settings.

Then, you can select whether you want to use a category tree for the catalog, as well as show the catalog to non-authenticated users. When activating this option, remember that courses and training materials reside at a global level. Subsequently, the categories used to organize them are also at the global level, but they can be assigned to catalogs across the domains.

You can also choose whether to show all available public courses or learning plans, or choose to display a specific catalog. Define whether to enable the Share this View button in the top right corner of domain internal and external catalogs and in the Course Catalogs tab of the domain Global Search results page so that users can use it to copy the page link on their clipboard in order to share the filtered results of their search within the catalog with other users.

Please refer to the Advanced Filtering article for further information on sharing filtered page deeplinks. This option activates the Share this View button in the catalog page; if the catalog is displayed in a Catalog Widget, activate the button in the pages including the widget. Further information on widget pages. Press Save Changes when finished.

Virtual Coach Tab

This tab allows you to apply specific settings for the Virtual Coach, by enabling or disabling the functionality at domain level. Select Enable custom settings for this client and configure settings as needed. Remember that the Virtual Coach is activated by default in all of the domains.

Press Save Changes when finished.

E-Commerce Tab

This tab allows you to apply specific E-Commerce settings (assign the currency, account, payment gateways and wire transfer options) for the selected client. In order to enable the customization of this area, select the option Enable custom settings for this client. Now, you can insert a specific currency symbol to display to the end-users of this client and select a currency from the dropdown menu.

Press Save Changes when finished.

Self Registration Tab

In this tab, you can apply a specific registration type to users in this domain. Begin by selecting the option to enable custom settings for the client. Then, select whether you want to allow quick registration for these learners when they register into the platform.

Next, select whether these users can have free self-registration, moderated self-registration, or only-by-administrator registration. Learn more about the different registration types.

You can also select the option to not send the confirmation email to users upon self-registration if you've allowed free or moderated self-registration, but please note that selecting this option means that you will have to manually send users their credentials.

Next, you can restrict user registration into the platform to a specific email domain, so users registering themselves using an email with a different domain will be automatically rejected. Define the domains that are allowed by inserting the list of domains in the Restrict Domains field.

Please Note: This feature only works with the self-registration and the moderated registration policies.

Press Save Changes when finished.

Auth0 Settings Tab

In this tab, you can activate Auth0 for this specific client. With this integration, you can allow users to log into their Docebo platforms using credentials from an active session of other web platforms. Find out more about the integration with Auth0.

LDAP App Settings Tab

If you have activated the LDAP app, you can assign a specific LDAP configuration to each domain you have in your Extended Enterprise platform. Users who access the platform from different URLs will be able to authenticate their credentials through different LDAP systems. Find out more about the integration with LDAP. When finished, press Save Changes.

OpenID Connect Settings Tab

If you have activated the OpenID Connect app, you can assign a specific OpenID Connect configuration to each domain you have in your Extended Enterprise platform. Find out more about the integration with OpenID Connect. When finished, press Save Changes.

SAML 2.0 Settings Tab

SAML 2.0 allows users to use SAML to sign in between their active directory and the platform for each Extended Enterprise client. Activating this app allows your users to log in to their computer and, with an active session, also sign into the Docebo platform, using the domain assigned to each one by the Extended Enterprise app.

Learn more about the settings in this tab. Press Save Changes when finished.

Please Note! In a multi-domain scenario where different instances are leveraging different SSO protocols, either Auth0, LDAP, OpenID Connect or SAML can be configured at the domain level. However, if the API and SSO app is being leveraged at the root level to include the Force External SSO option, it will supersede the multi-domain SSO settings and thus apply to the entire domain. This is likely to affect a use case where you wish to set up a service-provider-initiated SSO on a multi-domain.

Language Settings Tab

Use this tab to manage the active set of languages and assign a default language for the clients of your Extended Enterprise. To edit the languages, select the option to Enable custom settings for this client. The language list below will no longer be greyed out.

In the last column for each row, you will see a checkmark to activate or deactivate a language. Simply click the checkmark to do so. A green checkmark means the language is active, and a grey checkmark means the language is not active.

In the Default column, you can click on a flag in a language’s row to make the flag green, thus setting it as the default language for that client.

Subscription Settings Tab

For those using the subscriptions module in Docebo, you can apply specific settings to a client of your Extended Enterprise, overriding any global settings that you configured for the module. Simply select the option at the top of the tab to enable custom settings for the client, then select any of the subscription options that you want to apply. Learn more about subscriptions. When finished, press Save Changes.

User Options Tab

In this tab, you can manage various options for the selected client that apply to the user creation or to the login procedure. 

Begin by activating the option to enable custom settings for the client. You can now take advantage of the following options:

Auto-Calculate Password

• Automatically calculate password: use this option to enable the platform to automatically generate a password for users, upon creation. Further information on the platform password management policy.

Change Password

• Prevent users from changing their password: when this option is enabled, users will not see the Change Password tab in the My Profile area (on desktop and on mobile), in the My Profile widget as well in the password reset option in the login form. This option applies to both the desktop and mobile versions of the platform. This option is enabled by default when the Show only SSO buttons and hide login form toggle is enabled in the configure Branding and Look menu of your platform so that users logging into the platform with the Single Sign On do not have the option to change their password in the platform and will keep the one set in the Identity Provider. The configuration of this option does not affect Superadmins.

Hide My Profile and Preferences Sections

• Hide the Personal Info tab except for the avatar image in the My Profile area for all users: use this option to hide all of the fields of the Personal Info tab, except for the avatar image in the My Profile area for all users.
• Hide the Preferences tab in the My Profile area for users and Power Users:  use this option to hide the Preferences tab in the My Profile area for users and Power Users. The tab will still be visible for Superadmins.

Use Email as Username 

• Use Email as Username: use this option to use email addresses as usernames. When enabling this option, make sure that your users are associated with valid email addresses. Please note that:
  • the email address used as the username is the one associated to the user in the Users menu of your platform. If users update their email address in their personal area, their username is not updated to reflect the new email address, while when the Superadmin or the Power User (with granted permissions) updates the user email address in the Users menu, they can also decide to update the username.
  • when creating or updating users via API or through SSO (Single Sign-On) provisioning, you must provide values both for the email and for the username, even when this option is enabled. 

Login

• Enable "Remember Me" Functionality: enable this option to show the Remember Me option in the login page (both on desktop and on mobile). When users select the option, the platform will no longer ask them to enter their username and password to log in, but will automatically log them in upon connection.

Platform Language Selection (NEW!)

• Make the language selected during the pre-login mandatory steps as the user’s default language: enable this option to set the language preferences selected by users during the pre-login phase to read and give consent to the conditions of use as their preferred language. When this option is enabled, it’s highly suggested to keep the Hide the Preferences tab in the My Profile area for users and Power Users option disabled so that users can see the Preferences tab in the My Profile area. Usage Tip: When activating this option, create a shortcut to the My Profile / Preferences tab to make it easier for learners to manage their language preferences (for example, use the Custom Content Box widget embedding the URL of the My Profile page).

Privacy Policy Tab

Whether you have activated the privacy policy globally from your main domain or not, you can locally activate or deactivate the privacy policy for a subdomain in the Extended Enterprise settings. Remember that local settings take priority over the global configuration for the privacy policy, so any settings that you configure for that subdomain will always override any global privacy policy settings that you’ve configured.

In the Privacy Policy tab, select the option in the first section to Enable custom settings for this client. Now, you will see that the Privacy Policy section is no longer greyed out. Depending on how you’ve set the global settings for all domains, you can select the option to not require a policy signature for users in this subdomain (meaning that these users will not have to accept a privacy policy before accessing their platforms), or you can select the Assign a policy option.

If you select the second option, use the Select a policy dropdown menu to assign a privacy policy for this domain of your Extended Enterprise. Alternatively, you can assign a privacy policy to this subdomain from the Privacy Policy management area of your platform. The assigned policy will be reflected in the interface of the Privacy Policy tab in the subdomain’s settings. Likewise, if you assign a policy to the client in the settings area for the subdomain, it will be reflected in the interface of the Privacy Policy management area of your platform. Press Save Changes once finished.

Upon assigning a privacy policy to a subdomain, all users in that subdomain must accept that privacy policy upon their next log into the platform. Learn more about managing your privacy policy.

Terms and Conditions Tab

Whether you have activated the terms and conditions globally from your main domain or not, you can locally activate or deactivate terms and conditions for a subdomain in the Extended Enterprise settings. Remember that local settings take priority over the global configuration for the terms and conditions, so any settings that you configure for that subdomain will always override any global terms and conditions settings that you’ve configured.

In the Terms & Conditions tab, select the option in the first section to Enable custom settings for this client. Now, you will see that the Terms & Conditions section is no longer greyed out. Depending on how you’ve set the global settings for all domains, you can select the option to not require a policy signature for users in this subdomain (meaning that these users will not have to accept a privacy policy before accessing their platforms), or you can select the Assign a Terms and Conditions record option.

If you select the second option, use the dropdown menu to assign terms and conditions for this domain of your Extended Enterprise. Alternatively, you can assign terms and conditions to this subdomain from the Terms and Conditions management area of your platform. The assigned terms and conditions will be reflected in the interface of the Terms & Conditions tab in the subdomain’s settings. Likewise, if you assign terms and conditions to the client in the settings area for the subdomain, it will be reflected in the interface of the Terms & Conditions management area of your platform. Press Save Changes once finished.

Upon assigning terms & conditions to a subdomain, all users in that subdomain must accept those terms & conditions upon their next log into the platform. Learn more about terms and conditions.

Advanced Tab

In this tab, you can select whether to activate the "send notification" option when Admins create new users. Upon creating the new user, the User has been created (by administrator) will be sent to the email address that you added for the user.

Please Note! The User has been created (by administrator) notification must already be configured and activated using the Notifications app if you want to use this feature.

When finished, press Save Changes.

Teams and Managers Tab

For those using the My Team functionality in Docebo, you can apply specific settings to a client of your Extended Enterprise, overriding any global settings you have configured. Simply select the option at the top of the tab to enable custom settings for the client, then configure the available options according to your needs. Further information on My Team.

Best practices

The Extended Enterprise app is recommended in the following use cases:

• Internal: You have business units in your company and you want to separate for users the login page to the platform (e. g. with their own language and look & feel). You need to delegate to some power users limited control over specific users.
• External: You sell courses to your clients and you want to provide them separated login page, domain and look & feel.
• Internal/External: A combination of the previous ones.

The Extended Enterprise app does not work in case:

• You want to partition the platform in instances and allocate an independent Superadmin per branch. Superadmin has always visibility on the whole platform configuration, contents, users.

Please Note! As of February 10, 2022, for security reasons text field input validation has been modified to enhance the security in the Extended Enterprise app and no longer accepts certain characters for input in text fields. Please see the complete list of special characters for more information.

Subfolder Restrictions for Extended Enterprise Clients

When creating subfolders for Extended Enterprise clients, you cannot create subfolders that start with or are labeled exactly as the following words:

• db

• hybridauth

• doceboLms

• addons

• admin

• api

• authoring

• common

• gapps

• lms

• app7020

• mobile

• moxiemanager

• plugins

• custom_plugins

• tcapi

• themes

• sso

• oauth2

• pens

• webapp

• cookiebaker

• simplesaml

• offline.php

• check_*.php

• legacy

• learn/v1

• demo/v1

• manage/v1

• notifications/v1

• share/v1

• skill/v1

• docs/v1

• debug

• hydra-assets

• learn

• demo

• manage

• notifications

• share

• skill

• docs

• unauthorized

• public

• ecommerce/v1

• setup/v1

• salesforce/v1

• setup

• ecommerce

• salesforce

• marketplace

• marketplace/v1

• report

• report/v1

• pages

• pages/v1

• otj

• otj/v1

• audittrail

• audittrail/v1

• course

• course/v1

• analytics

• analytics/v1

• audiences

• audiences/v1

• impact

• impact/v1

• poweruser

• poweruser/v1

• learningplan

• learningplan/v1

• bamboohr

• bamboohr/v1

• course

• course/v1

• erp

• erp/v1

• ipaas

• ipaas/v1

• trms

• trms/v1

• tmrepo

• tmrepo/v1

• loki

• assets

• dcd

• doceboCore

• doceboScs

• files

• i18n

• images

• lib

• media

• templates

• tos

• widget

• yii

• documentation

• scormcmd

• index.php

• i.php

• server-status