Set up single sign-on (SAML or OIDC)

Let your team sign in with Microsoft Entra ID, Google Workspace, Okta or another identity provider, and enforce it with a break-glass admin.

For: Workspace admins (Enterprise add-on)

Steps

Open Settings → Single sign-on, choose your provider and the protocol (SAML 2.0 or OpenID Connect).
Copy our details into your identity provider: for SAML the entity ID and the Assertion Consumer Service URL, for OpenID Connect the redirect URI.
Bring your provider's details back: a SAML metadata URL or file (or the entity ID, sign-in URL and certificate), or the OIDC issuer, client ID and client secret. Select Save identity provider.
Under Verified domains, add your email domain, publish the TXT record shown at your DNS provider, then select Verify.
Select Test sign-in and sign in with your own account. The result screen shows what the provider sent and what would happen on a real sign-in.
Select Turn on. The sign-in page now shows Sign in with single sign-on.
Optional: under Enforce single sign-on, choose a break-glass administrator (needs a password and an authenticator app), tick Enforce single sign-on and save.

Just-in-time provisioning creates people on their first sign-in, only for verified domains and only while seats are free. Admins are alerted when the seat limit is reached.
Group claims use the same group mappings as SCIM, so a group can set role, team and seats.
While enforced, password, email link, passkey and social sign-in are hidden. The break-glass admin signs in from the Break-glass admin sign-in link with a password and an authenticator code; every use is audited and the other admins are told.
Rotating the IdP certificate? Add the new certificate (or save the metadata URL again) before your provider switches.

Still need help? Contact support

Let your team sign in with Microsoft Entra ID, Google Workspace, Okta or another identity provider, and enforce it with a break-glass admin.

For: Workspace admins (Enterprise add-on)

Open Settings → Single sign-on, choose your provider and the protocol (SAML 2.0 or OpenID Connect).
Copy our details into your identity provider: for SAML the entity ID and the Assertion Consumer Service URL, for OpenID Connect the redirect URI.
Bring your provider's details back: a SAML metadata URL or file (or the entity ID, sign-in URL and certificate), or the OIDC issuer, client ID and client secret. Select Save identity provider.
Under Verified domains, add your email domain, publish the TXT record shown at your DNS provider, then select Verify.
Select Test sign-in and sign in with your own account. The result screen shows what the provider sent and what would happen on a real sign-in.
Select Turn on. The sign-in page now shows Sign in with single sign-on.
Optional: under Enforce single sign-on, choose a break-glass administrator (needs a password and an authenticator app), tick Enforce single sign-on and save.

Just-in-time provisioning creates people on their first sign-in, only for verified domains and only while seats are free. Admins are alerted when the seat limit is reached.
Group claims use the same group mappings as SCIM, so a group can set role, team and seats.
While enforced, password, email link, passkey and social sign-in are hidden. The break-glass admin signs in from the Break-glass admin sign-in link with a password and an authenticator code; every use is audited and the other admins are told.
Rotating the IdP certificate? Add the new certificate (or save the metadata URL again) before your provider switches.

Still need help? Contact support