Skip to main content

Single sign-on (SSO)

Owners and admins, on plans that include single sign-on. SSO lets members sign in to your organization through your identity provider (for example Microsoft Entra ID, Okta or Google Workspace) using OpenID Connect.

1. Configure the identity provider​

In Organization settings → Single sign-on (SSO):

  1. Enter the Work email domain exactly, without @, for example example.com. Only addresses on this domain can use the connection.
  2. In your identity provider, create a confidential web application and register the Redirect URI and Back-channel logout URI shown on the page.
  3. Enter the OpenID Connect issuer URL (your tenant-specific HTTPS issuer), the Client ID and the Client secret, and save.

Changing the domain, issuer or client ID later disables SSO and resets testing, approval, sessions and account links, so plan a maintenance window.

2. Complete the activation checklist​

StepHow
Verify domain ownershipAdd the TXT record name and TXT record value to your domain's DNS, then Check DNS record. Keep the record while SSO is configured.
Test identity providerStart sign-in test and sign in at your provider with the same verified work email as your account. The test does not create or link accounts.
Platform approvalThe platform administrators review the domain and provider. Refresh status shows the result.

3. Enable member access​

  • Enable SSO sign-in offers Continue with SSO to members.
  • Link SSO account — each member links their existing account once, using the same verified work email. Link your own account first, before you require SSO.
  • Require SSO to access this organization makes members use SSO even when already signed in. Owners keep their other sign-in methods for recovery. Other organizations are unaffected.
  • Create accounts on first sign-in lets verified emails on your domain join automatically, within your member limit, with the Role for new members (viewer or editor). Existing accounts must still be linked.

SSO sessions last 12 hours. A session started with SSO grants access to that organization only; to manage account security or other organizations, sign out and sign in another way.

Remove SSO​

Remove SSO connection deletes the provider, releases the domain and ends SSO access. Members need another sign-in method; owners keep recovery access.

For members​

Link your account once in Settings → Single sign-on (SSO) with Link SSO account, signing in at your identity provider with your work email. Afterwards, choose Continue with SSO on the sign-in page. If SSO is required and you unlink, you lose access to the organization until you link again.