Open Settings and choose Single sign-on and SCIM. Single sign-on is part of an Enterprise contract; choose Contact sales to add it.
1. Verify your email domains
Single sign-on is offered to people whose email address is on a domain you've proved you control.
- Under Email domains, choose Add domain and enter it, such as example.com.
- Publish the TXT record the screen shows, at your domain's DNS provider.
- Choose Verify.
2. Add a connection
Under Add a connection, choose the protocol and fill in:
- Name: what your team calls the provider, such as Okta or Entra ID.
- Role for new members: people who sign in for the first time join the workspace with this role.
- For OpenID Connect: the Issuer URL, Client ID and Client secret. The secret is stored for the token exchange and never shown again.
- For SAML: the identity provider's entity ID, sign-in URL and signing certificate, in PEM format.
Copy the Details for your identity provider into your provider's settings: the redirect URI, or for SAML the assertion consumer service URL, entity ID and metadata.
3. Test and activate
Choose Try sign-in to test the connection, then Activate. Members with a verified domain can then sign in through it. Switch off stops it without deleting it.
Deleting a connection doesn't delete anyone: members who signed in through it keep their accounts and can still sign in by email.
SCIM provisioning
Your identity provider can create, update and deactivate members through the SCIM base URL with a bearer token.
- Under Tokens, name a token and choose Create token.
- Copy it at once. It's shown once and can't be recovered.
- Paste the base URL and token into your provider.
Deactivating someone removes their access to the organisation. Their codes keep working. Revoke a token to stop provisioning with it.
Group roles
Groups your provider pushes over SCIM appear under Group roles. Give a group a role, and its members take the most senior role among their groups.