← All documentation

Single sign-on

SAML single sign-on is included in Premium and Enterprise. It is not on the
Free plan.

Settings → Single sign-on connects your organization to your identity provider (the page has steps for Okta, Microsoft Entra ID and Google Workspace; any SAML 2.0 provider works). Only an organization admin can change it.

Setting it up

  1. Copy the Entity ID and the ACS URL from the page into a new SAML application at your identity provider.
  2. Paste your provider's federation metadata (XML or a URL to it), or enter its Entity ID, SSO URL and certificate by hand.
  3. Turn on SAML SSO and save.
  4. Share the organization's sign-in link with your members. A member who has no account yet must use that link: the email-based sign-in finds only existing accounts.

Options

  • Force SSO: members must sign in through your identity provider, and password sign-in is blocked for them. Test SSO with a second admin before you turn it on.
  • SSO satisfies MFA: turn on only if your identity provider enforces multi-factor authentication itself. A successful SSO sign-in then counts as the second factor.
  • Allowed email domains: a new person your provider asserts gets an account only if their email domain is listed. Leave it empty to create no accounts automatically: existing members can still sign in, and new people are invited.
  • Group to role mapping: map your provider's groups to Admin, Contributor or Auditor. The role is re-synced on every sign-in.

Platform staff accounts cannot sign in through an organization's identity provider.