Single Sign-On

Single Sign-On lets teams use an identity provider to manage sign-in for an organization. SSO is useful for companies that need centralized access control.

SSO availability depends on your plan.

How the setup works

Setup is an exchange in two directions, which is why the form is ordered in two steps:

1. You give your identity provider some URLs from us — a callback URL (OIDC) or an ACS URL and metadata URL (SAML). These are shown in the form as soon as you pick a protocol and enter your domain, before you fill anything else in.
2. Your identity provider gives you some values back — an issuer URL and client credentials (OIDC), or a sign-in URL and certificate (SAML).

Do step 1 first. The URLs in step 1 depend only on your domain and provider ID, so they are ready before you create anything on the provider’s side.

For OIDC you only need the issuer URL — the base address of your provider. We fetch its OpenID configuration automatically, so you never need to enter the authorization, token or JWKS endpoints by hand, and you should not append /.well-known/openid-configuration yourself.

What you need

OIDC — domain, provider ID, issuer URL, client ID, client secret.

SAML — domain, provider ID, issuer URL, sign-in URL, and the IdP signing certificate.

Add an SSO provider

1. Open Team Settings and confirm the correct organization is active.
2. Go to Single Sign-On and choose Add provider.
3. Pick the protocol and enter your domain. A provider ID is suggested for you.
4. Copy the URLs shown in step 1 into your identity provider.
5. Paste the values your provider gives you into step 2.
6. Choose Test connection. Registration stays disabled until it passes, so a provider is never created from details that cannot work.
7. Register the provider, then test a real sign-in before requiring SSO for the domain.

For OIDC, pick your provider from the Identity provider list and enter just your tenant — the issuer URL is built for you. Choose Other to type it in full.

For SAML, paste your provider’s metadata URL (or the XML itself) and choose Import metadata. The sign-in URL and signing certificate are read out of the document and filled in for you.

Auth0

1. Applications → Create Application → Regular Web Application.
2. In Settings → Allowed Callback URLs, paste the callback URL from step 1.
3. Copy Client ID and Client Secret from the same page.
4. For Auth0 domain, copy the Domain field shown on that same settings page — it includes your region, for example acme.eu.auth0.com.

Auth0’s Import from URL tab does not apply here. It expects a Client ID Metadata Document, which describes a public client with no client secret; enterprise SSO needs a confidential one. Use Create Manually.

Okta

1. Applications → Create App Integration → OIDC → Web Application.
2. Paste the callback URL from step 1 into Sign-in redirect URIs.
3. Copy Client ID and Client secret.
4. For Okta domain, use your org’s domain — acme.okta.com, or acme.oktapreview.com for a preview org. If you use a custom authorization server, choose Other and enter its issuer in full.

OneLogin

1. Applications → Add App → OpenID Connect (OIDC).
2. Paste the callback URL from step 1 into Redirect URIs.
3. Copy the Client ID and Client Secret from SSO.
4. For OneLogin subdomain, use just the subdomain — acme for acme.onelogin.com.

PingOne

1. Applications → Add Application → OIDC Web App.
2. Paste the callback URL from step 1 into Redirect URIs.
3. Copy the Client ID and Client Secret.
4. For Environment ID, use the environment’s ID from Settings → Environment.

JumpCloud

1. SSO Applications → Add New Application → Custom OIDC App.
2. Paste the callback URL from step 1 into Redirect URIs.
3. Copy the Client ID and Client Secret.
4. No tenant value is needed — JumpCloud’s issuer is the same for everyone.

Microsoft Entra ID

1. App registrations → New registration, and add the callback URL from step 1 as a Web redirect URI.
2. Create a secret under Certificates & secrets and copy its value — it is only shown once.
3. Client ID is the Application (client) ID.
4. For Directory (tenant) ID, use the GUID from Overview. Do not use common — that shared endpoint reports a placeholder issuer and will be rejected.

SAML providers

Metadata flows both ways, and using it on both sides means almost nothing has to be typed:

• Into your provider — most SAML IdPs can import our metadata URL directly instead of you filling fields one by one. Look for “import from URL” or “metadata URL” when creating the application. The same URL is also the SP Entity ID / Audience value if your provider asks for it separately.
• Into iSearchFrom — paste your provider’s metadata URL into the setup form and choose Import metadata. We read the sign-in URL and signing certificate from it.

Re-importing is also how you rotate an expiring certificate: paste the same metadata URL again and the new certificate replaces the old one.

Require SSO for a domain

After testing, you can require SSO for users on the configured domain. Be careful: if the provider is misconfigured, users may be blocked from signing in. Test a real sign-in first.

Troubleshooting

The form reports the specific reason a registration failed. The common ones:

Message	What to do
No OpenID configuration found at that issuer URL	Use the provider’s base URL, without /.well-known/openid-configuration
Provider reports a different issuer URL	Copy the exact issuer value from your provider’s OpenID configuration
Could not reach your identity provider	Check the issuer URL is correct and reachable from the public internet
Issuer URL must be a public https address	Internal or private hosts cannot be reached — expose the provider publicly
A provider with this Provider ID already exists	Choose a different ID, or delete the existing provider first
Only an owner or admin can register a provider	Ask a workspace owner or admin to complete the setup
Redirect fails after sign-in	Confirm the callback URL from step 1 is allowed in the identity provider, character for character
SSO not available	Confirm your plan includes SSO

Open in iSearchFrom

Open Team Settings in the app. Organization SSO settings and domain enforcement belong with team/organization controls.

Related docs

• Invite Team Members
• Security and 2FA
• Manage Subscription