Team & account
Single sign-on (SSO) with your identity provider
Your team signs in with your company's Okta, Microsoft Entra ID, Google Workspace or any OIDC or SAML identity provider. Admins set it up in Settings → Privacy and security.
- 1Start the setupSettings → Privacy and security → Single sign-on → Set up with OIDC or Set up with SAML. Settio shows what your identity provider asks for: the redirect URI for OIDC, or the ACS URL, entity ID and metadata URL for SAML. Create the app in your identity provider with them, and send the email address (the email claim or attribute).
- 2Enter your identity provider's detailsFor OIDC: the issuer URL, client ID and client secret. For SAML: paste the identity provider's metadata XML, or the sign-in URL and signing certificate. The client secret is stored encrypted and never shown again.
- 3Verify your email domainsAdd your domain (for example example.com) and create the TXT record Settio shows at _settio.example.com in your DNS, then click Verify. Only addresses on verified domains can sign in with your identity provider, and a domain belongs to one workspace. Public mailbox providers such as Gmail can't be used.
- 4TestTest sign-in sends you through your identity provider and back to Settings without changing who's signed in. It says whether it worked and whether the email address was sent.
- 5Sign inOn the sign-in page, people click Sign in with SSO and type their work email. Someone already in the workspace signs straight in. An invited person's invitation is accepted. Anyone else on your domains is refused unless Create accounts on first sign-in is on: then they join as a Member or Viewer, as you choose.
- 6Require single sign-onOnce a domain is verified and a test worked, Require single sign-on stops password and Google sign-ins for addresses on your verified domains. Turn it off or remove single sign-on at any time; people who never set a password use Forgot password?.
Changing the identity provider's details turns Require single sign-on off until a new test works, so a typo never locks your team out.
Every change to single sign-on is in the audit log (Reports → Exports), and each sign-in is recorded with its method.
Google sign-in also works without SSO: Continue with Google signs in an existing account, creates a workspace on the sign-up page and accepts an invitation for the same address.
Informational only. This guide is not legal advice. Always verify requirements with official government sources before acting. About this information