Enterprise SSO

Prerequisites

• Enterprise plan on the workspace.
• You're an owner or admin of that workspace.
• You can edit DNS for the email domain you'll use.

1. Provision a connection

1. Open Settings → SSO.
2. Click New connection and choose SAML 2.0 or OIDC.
3. We give you an ACS URL and entity ID to paste into your IdP.

2. Verify your domain

1. Enter the email domain (e.g. contoso.com).
2. Add the TXT record we display to your DNS. Verification polls every 60 seconds.
3. Once verified, every user signing in with that domain is routed through your IdP.

3. Configure your IdP

SAML

• NameID format: emailAddress.
• Attribute statements: email, given_name, family_name, optional role.

OIDC

• Scopes: openid, profile, email.
• Optional custom claim migrateto_role for just-in-time role mapping.

4. Pre-invite users

From Settings → SSO → Invitations you can pre-create memberships with role assignments. On first SSO sign-in the invitation is consumed automatically.

5. Enforce SSO

Just-in-time provisioning

If your IdP sends migrateto_role, we map the value to the workspace role on every sign-in. Valid values: admin, editor, viewer. Unrecognized values default to viewer.