Single sign-on overview

We speak SAML 2.0 and OpenID Connect, which between them cover Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, and nearly every other identity provider. There's no per-vendor integration to wait for — if your provider speaks either protocol, it connects.

How it works for your staff. They go to the SSO page (linked from the login screen), enter their work email, and the domain routes them to your identity provider to sign in. Someone arriving for the first time gets an account in your organization automatically, as long as a seat is open. Their email arrives already verified — your identity provider vouched for the mailbox — and they're enrolled and landed straight in chapter 1. There's nothing to distribute and no invite link involved.

Setting it up. An organization admin opens Settings → Organization, scrolls to Single sign-on, and picks a protocol. For SAML you'll paste three things from your provider: the IdP entity ID, the sign-on URL, and the X.509 certificate. For OpenID Connect it's the issuer URL, client ID, and client secret. Saving the connection reveals the values your provider needs from us — the SP entity ID, ACS URL, and metadata URL for SAML, or the redirect URI for OIDC — each with a copy button. A test button checks that the metadata is reachable and the certificate parses before you enable anything. Field-by-field walkthroughs: Okta, Microsoft Entra, Google Workspace.

Requiring SSO. With a connection enabled you can turn on "Require SSO," which closes the side doors for your members: both passwords and passkeys stop working for them, and the login page points them to your identity provider instead. Organization admins are deliberately exempt from the requirement — if your IdP is ever misconfigured, an admin can still sign in the ordinary way and fix the connection rather than locking the whole organization out.

Vendor field names drift. If your provider's console doesn't match a walkthrough word for word, remember the values are always the same three for SAML (entity ID, sign-on URL, certificate) and three for OIDC (issuer, client ID, client secret) — map by meaning rather than label.

For keeping the roster itself in sync — accounts created on hire and removed on departure — see automatic provisioning with SCIM.