Single sign-on

Connect your workspace to a SAML 2.0 identity provider.

Single sign-on is available on Business and Enterprise plans under Settings → SSO.

Who can change SSO

Only workspace owners can create, replace, edit or remove the SSO configuration. Admins and other workspace members can view an existing configuration and test sign-in, but cannot change it. Ask an owner to save settings supplied by your identity provider administrator.

An identity provider authenticates accounts on the workspace's verified email domains. Those accounts may also have access to other workspaces, so choosing or replacing that provider is an owner responsibility.

Set up your provider

  1. Verify your organization's email domain under Settings → Domains using its DNS TXT record.
  2. Give your provider the Service Provider Entity ID, ACS callback URL and metadata URL shown in SSO settings.
  3. As an owner, enter the provider's Entity ID, SSO URL and X.509 signing certificate. Choose verified email domains and the default role for newly provisioned members.
  4. Save the configuration, enable SSO and use Test SSO to check your provider's sign-in flow.

SSO must have at least one verified email domain before it can be enabled. Listed domains with expired verification cannot authenticate accounts. Owners can switch SSO off or remove it when they need to recover access.

Changes and owner notices

Creation, reconfiguration, updates and removal are recorded in the workspace audit log. Each current owner receives an Inbox notice linking to that workspace's SSO settings, subject to their in-app notification and service alert preferences. The notice also appears in the notification bell. Notices and audit entries never contain the signing certificate.