Single sign-on (SAML)

What it does — and doesn't — do

SSO signs a member in by matching the email your IdP asserts against a member of this organization. By default it does not create accounts — someone with no membership here is rejected, not silently added. Turn on Create accounts on first sign-in to let anyone your IdP admits join as a Member, within your plan's seats; a member you deactivated is never brought back. Members with two-factor authentication are still asked for their code.

Setting it up

• Register the ACS URL and SP entity ID shown on this page with your IdP — or give it the SP metadata URL if it can import one.
• Share the sign-in link with your team, or have them choose Sign in with SSO and enter this workspace's URL name.
• IdP entity ID / issuer — your IdP's own identifier for this app integration.
• IdP SSO URL — where your IdP receives login requests (sometimes called the "Sign-on URL" or "SSO endpoint").
• IdP signing certificate — the public certificate (PEM format) your IdP uses to sign assertions, so this app can verify they're genuine.
• Email attribute name — which attribute in the SAML assertion carries the user's email. Defaults to email; check your IdP's attribute mapping if sign-in fails with a missing-attribute error.