Single Sign-On
Let your team sign in with the company account they already use (Microsoft Entra ID, Okta, Google Workspace and other SAML identity providers) and control who gets into this company.
Open your dashboard1. Verify a domain
- In Single Sign-On, enter the email domain your team signs in with (for example yourcompany.com) and click Add domain.
- Copy the DNS TXT record value shown and add it as a TXT record at the root (@) of that domain with your DNS provider.
- Click Verify. DNS changes can take a few minutes to appear.
2. Connect your identity provider
- In your identity provider, create a SAML app. Give it the SP Entity ID and ACS / Reply URL shown on the page (use the Copy buttons).
- Back in the app, paste your provider’s metadata URL or XML. That fills in the issuer, sign-on URL and signing certificate for you. You can also enter them by hand.
- Click Save SSO settings. You can do this step before the domain is verified.
The page links to step-by-step guides for common providers.
3. Choose the options
- Enable SSO: people on a verified domain can sign in through your identity provider.
- Require SSO: password sign-in is blocked for your domain, so members must use SSO.
- Auto-add people from this domain: on their first SSO sign-in, people on a verified domain are added to this company.
These options unlock once a domain is verified.
Turn on Require SSO only after you have signed in with SSO yourself, so you
don’t lock your own account out.