Sign in with your company login
Verify a domain and wire your identity provider as the way into this workspace.
Sign in with your company login. Your identity provider adds and removes people for you. Settings then Single Sign-On is where that gets wired.
Two faces of one page
Before sign-ins are accepted, the page is a four-step setup in the order your provider needs.
Verify a domain you own.
Connect the provider by pasting its metadata.
Point the directory at penv so it can manage the roster. This step is optional and the page marks it so.
Require everyone to arrive that way.
Afterward the same page becomes a health board showing the state of each domain and when the signing certificate expires, alongside whether the directory is syncing and the last sign-in it saw.
Domains
/settings/sso/domains adds a domain, shows the TXT record to publish, verifies it, and removes it. A verified domain is what lets your provider create members here.
Domain verification is free on every plan. Proving you own a domain is not a feature anybody should pay for.
Losing your last verified domain lifts the requirement that everybody signs in through the provider. The whole console reads that state.
The connection
/settings/sso/connection takes your provider's metadata, hands you back the two URLs to paste into it, and turns the connection on or off. The same page re-reads metadata on a certificate rotation, so day one and rotation day are the same action.
Below that, claims map to roles. A default role covers anybody arriving with no matching group, and a group map sends named groups to named roles. A group naming a role that is not this workspace's is refused rather than skipped quietly.
Requiring it
Requiring single sign-on closes the password path for everyone except an owner, who stays the way back in. An owner arriving that way is recorded as org.break_glass_login.
Turning the requirement off is never gated on your plan, and neither is removing a connection or a domain. A lapsed plan must never lock an admin out of their own connection.
Plan
The connection and the directory are Enterprise. Social sign-in is free on every plan, and so is domain verification. The gate stops a workspace building federation and never takes down what it already has.
A workspace with no plan for it and nothing configured yet sees that explanation instead of a form. A workspace whose plan lapsed with a connection or a directory already in place keeps the whole page, behind a notice saying what is set up keeps working and changing it needs Enterprise.
What each action needs
Every action here needs sso:manage and asks you to confirm it is you (step-up). The column below says which ones also need Enterprise.
| Action | Needs | Confirm it is you | Also needs Enterprise |
|---|---|---|---|
| Add a domain | sso:manage | Yes | No |
| Verify a domain | sso:manage | Yes | No |
| Remove a domain | sso:manage | Yes | No |
| Save or re-read metadata | sso:manage | Yes | Yes |
| Change the claim mapping | sso:manage | Yes | Yes |
| Turn the connection on | sso:manage | Yes | Yes |
| Turn the connection off | sso:manage | Yes | No |
| Remove the connection | sso:manage | Yes | No |
| Change the sign-in requirement | sso:manage | Yes | No |
Reading the page needs sso:read.
What lands in the record
| Entry | What wrote it |
|---|---|
org.domain_added | Adding a domain |
org.domain_verified | Verifying it |
org.domain_removed | Removing it |
org.sso_connection_created | Saving your provider's metadata for the first time |
org.sso_connection_updated | Re-reading metadata, changing the claim mapping, turning the connection on or off |
org.sso_connection_removed | Removing the connection |
org.sso_required | Changing the sign-in requirement, on or off, with the new state in the entry |
org.sso_required_off | The requirement lifted for you, because the connection was suspended or removed or the last verified domain went |
None of the org.* entries above appears in the action picker on the Audit Log page, and neither does org.break_glass_login. Narrow by actor and date, then export. See browsing the record.
member.signed_out_by_idp lands when your provider signs somebody out, and the picker does carry that one. A sign-out ends sessions and never closes a seat.