Single sign-on (SSO)

Configure SAML so your users log in with company credentials.

Why configure SSO?

Without SSO, users sign in with an email and password (or a social login). With SSO, they authenticate through your identity provider — Okta, Microsoft Entra, OneLogin, Auth0, or any SAML 2.0-compatible IdP. Once configured, users whose email belongs to your organization are sent to your IdP to sign in, and access is revoked the moment you offboard someone in your IdP.

SSO is available on the Team plan and above. Find it under Organization → SSO.

Before you start: verify your email domain

The platform decides who signs in through your IdP by looking at the domain of their email address. Add and verify your company's domain under Organization → Settings → Domains first (you'll be shown a DNS record to add, then click verify). Until the domain is verified, users with that domain won't be routed to your IdP.

Choosing a provider

Under Organization → SSO you choose one of three providers:

For a click-by-click walkthrough of a specific IdP, see Setting up Okta.

Setting up SAML

1. In your IdP, create a new SAML application.
2. Set the ACS URL (Assertion Consumer Service) and the Entity ID (also called Audience URI) to the two values shown in the Add these URLs to your Identity Provider box on the SAML setup screen. The Entity ID is also the URL of the service provider metadata.
3. Map the following attributes from your IdP user profile:
   • email → user's email address (required)
   • firstName → first name (optional)
   • lastName → last name (optional)
4. Make sure your IdP signs the SAML assertions (Okta, Microsoft Entra and Google Workspace do by default). Unsigned assertions are rejected.
5. Copy the IdP's Entry Point URL (its SSO URL), IdP Entity ID (Issuer), and X.509 Certificate.
6. Paste those into Provider Configuration on the SAML setup screen.
7. Under Member Sync, choose how users are provisioned (see below), then click Configure SSO.

Member sync

The Member Sync section of the setup screen controls provisioning:

• Sync Method — SCIM 2.0 (recommended; your IdP pushes changes to the platform — see the SCIM guide) or Directory Polling.
• Auto-provision new members — automatically create accounts for new directory users. When this is on, a person who signs in through SSO for the first time and has no account gets one created from the name and email in your IdP's assertion (just-in-time provisioning). When it's off, that person is told to contact their administrator.
• Auto-deactivate removed members and Auto-reactivate restored members — deactivate accounts when users leave the directory, and reactivate them if they return.
• Default role for new members — Member or Admin.

Once SSO is configured, the same panel shows the last sync time and any last sync error.

Going live

After you click Configure SSO, the settings page shows a Status section. Turn on Enable SSO to start routing users at your verified domain through your IdP. There is no separate test button, so verify the flow yourself: sign in with a test user in an incognito window before you tell anyone else.

Each time you change the IdP details, use Edit Configuration and save.

To turn SSO off and remove the configuration, use Disable SSO under Danger Zone. Members will need to use email/password login afterwards.

Enforcing SSO for all users

If you want to prevent email/password login for your organization's members, turn on Enforce SSO (it appears once SSO is enabled). You'll be asked to confirm. From then on, members with a verified-domain email who try to sign in with a password are told that their organization requires SSO.

Make sure at least one org admin has signed in through your IdP successfully before enforcing — if your IdP configuration breaks while SSO is enforced, you'll need to contact support to regain access.