Skip to main content
Single sign-on (SSO) lets the people in your organization sign in to Sazabi through your identity provider (IdP), such as Okta, Microsoft Entra ID or Google Workspace. Sazabi supports SAML 2.0 and OpenID Connect (OIDC). An organization has one connection, over one protocol; to change protocols, delete the connection and set up a new one. SCIM provisioning lets your IdP add, update and remove members too. You manage SSO on Settings > Single sign-on, with the sazabi sso CLI, or with the Terraform provider. Run sazabi sso status to see your domains, the connection and which domains require SSO. Single sign-on needs a plan that includes it. Every organization can open the Single sign-on page; on a plan without it, the page shows “Upgrade your plan to use this feature.” and its controls are disabled. To enable single sign-on for your organization, contact Sazabi. Plan changes covers what happens when a plan stops including it.

​
Who can do what

​
Setup order

Set up SSO in this order, so no one is locked out: add your SSO domains, then configure the connection and test it, then choose break-glass owners and require SSO for your domains. Set up SCIM after the connection works.

​
In this section

SSO enforcement

How sign-in works, requiring SSO for a domain, and break-glass owners.

SCIM provisioning

How your IdP adds, matches and deactivates members.

Add SSO domains

Claim a domain and prove you control it.

Configure SSO

Connect Okta, Entra ID, Google Workspace or any SAML or OIDC provider.

Set up SCIM

Turn SCIM on and connect your identity provider.

Manage SCIM

Rotate the token, pause SCIM and watch for problems.

Troubleshooting SSO

Fix sign-in, connection test and domain verification failures.

Troubleshooting SCIM

Read SCIM status codes and fix provisioning failures.