Organization
Single sign-on
Let people sign in with your identity provider over OpenID Connect or SAML, and require it for your email domains.
- Plans
- Enterprise
- Who
- Owner, Admin
- Where
- Settings → Organization → Single sign-on
- How to enable
- Connect your identity provider, then verify your email domains.
Single sign-on lets people sign in through your company's identity provider, such as Okta, Microsoft Entra ID or Google Workspace, instead of using a separate password. Any provider that supports OpenID Connect or SAML 2.0 works.
How it works
- One connection, several domains. Each workspace connects one identity provider, which can serve several email domains. For OpenID Connect, the issuer URL is enough to find the rest. Client secrets are stored encrypted.
- Domain verification. A DNS TXT record proves each domain is yours, and adding one never interrupts the others. A domain belongs to one workspace; an unverified claim is released after a week.
- Signing in. People choose single sign-on on the sign-in page and enter their work email, which sends them to your identity provider. Only addresses on your verified domains are accepted.
- First sign-in. Someone with a pending invitation joins with the role from it, linked to the employee record HR created. With account creation on, anyone else on your verified domains joins with the default role you pick, Employee or HR, in your default location and department. Otherwise they're turned away.
- Checking new people. Account creation needs a default location, or their leave wouldn't work. Owners, admins and HR are emailed about each newcomer.
- Require SSO. After at least one sign-in through the connection has worked, you can require it. Password and Google sign-in then stop for every account with an email on a verified domain. The Owner keeps password sign-in for emergencies, and each use is recorded in the activity log.
Good to know
- Employee records added without an invitation have no email to match. Invite existing employees before turning on account creation, or they'll get a second record.
- People HR has offboarded are never let back in by a first sign-in. Rehiring is HR's decision.
- Your identity provider handles multi-factor authentication, so signing in with single sign-on never asks for the app's two-factor code. If you also require two-factor, people still have to set it up.
- Removing someone from your identity provider stops new sign-ins, but sessions they already have last until they expire.
- If you remove the connection, Require SSO turns off, and people who only ever signed in with single sign-on need to reset their password.
- If the workspace leaves Enterprise, sign-in through the connection stops. You can still remove it.