Single sign-on and SCIM

Verify your domain, connect OIDC or SAML, provision users.

Single sign-on lets staff sign in with your company identity instead of a separate password. SCIM keeps your user list in step with your identity provider. Both are set up per organisation under Settings, Single sign-on.

Verify your domain. Add your email domain and publish the DNS TXT record shown. A domain can be used for single sign-on only once it is verified, and a verified domain belongs to one organisation only.

Connect OIDC or SAML. Enter the connection details from your identity provider, using OIDC or SAML 2.0. The email address your provider sends must be on the verified domain and belong to an active user of your organisation. Test sign-in with one user before you roll it out; we can help you test with your provider.

Require it if you want. You can require single sign-on for your verified domain. Super admins keep password sign-in as a fallback in case the identity provider is unavailable. If your organisation requires two-factor sign-in, the identity provider's own multi-factor check counts, unless you also ask for the app code on single sign-on.

Provision with SCIM 2.0. Generate a SCIM token and give it to your identity provider, such as Okta or Microsoft Entra ID. The provider can then create, update and remove users automatically. New users get the default role you choose, which can never be super admin or carry more permission than you hold. SCIM covers users; group sync is not available yet. Revoking the token stops provisioning until you issue a new one.

Related articles