> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Let people sign in to Sazabi through your identity provider over SAML 2.0 or OpenID Connect, and manage members with SCIM.

Single sign-on (SSO) lets the people in your organization sign in to Sazabi through your identity provider (IdP), such as Okta, Microsoft Entra ID or Google Workspace. Sazabi supports **SAML 2.0** and **OpenID Connect (OIDC)**. An organization has **one connection**, over one protocol; to change protocols, delete the connection and set up a new one. SCIM provisioning lets your IdP add, update and remove members too.

You manage SSO on [**Settings > Single sign-on**](https://app.sazabi.com/settings/single-sign-on), with the `sazabi sso` CLI, or with the [Terraform provider](https://docs.sazabi.com/reference/terraform.md). Run `sazabi sso status` to see your domains, the connection and which domains require SSO.

Single sign-on needs a plan that includes it. Every organization can open the Single sign-on page; on a plan without it, the page shows "Upgrade your plan to use this feature." and its controls are disabled. To enable single sign-on for your organization, [contact Sazabi](https://docs.sazabi.com/guides/administer/support.md). [Plan changes](https://docs.sazabi.com/guides/administer/single-sign-on/enforcement.md#plan-changes) covers what happens when a plan stops including it.

## Who can do what

| Action | Who |
| - | - |
| See whether SSO is set up | Every member |
| Claim, verify and remove domains; see the service provider details; change the default role and **Add people on their first sign-in**; test the connection | Owners and admins |
| Create the connection, change its identity provider fields, delete it | Owners, or a secret key with permission to manage SSO (`can_manage_sso`) |
| Require SSO for a domain, choose break-glass owners | Owners, signed in to the dashboard |

## Setup order

Set up SSO in this order, so no one is locked out: add your SSO domains, then configure the connection and test it, then choose break-glass owners and require SSO for your domains. Set up SCIM after the connection works.

## In this section

> [card] [SSO enforcement](https://docs.sazabi.com/guides/administer/single-sign-on/enforcement.md)
>
> How sign-in works, requiring SSO for a domain, and break-glass owners.

> [card] [SCIM provisioning](https://docs.sazabi.com/guides/administer/single-sign-on/scim.md)
>
> How your IdP adds, matches and deactivates members.

> [card] [Add SSO domains](https://docs.sazabi.com/guides/administer/single-sign-on/domains.md)
>
> Claim a domain and prove you control it.

> [card] [Configure SSO](https://docs.sazabi.com/guides/administer/single-sign-on/setup.md)
>
> Connect Okta, Entra ID, Google Workspace or any SAML or OIDC provider.

> [card] [Set up SCIM](https://docs.sazabi.com/guides/administer/single-sign-on/scim-setup.md)
>
> Turn SCIM on and connect your identity provider.

> [card] [Manage SCIM](https://docs.sazabi.com/guides/administer/single-sign-on/scim-manage.md)
>
> Rotate the token, pause SCIM and watch for problems.

> [card] [Troubleshooting SSO](https://docs.sazabi.com/guides/administer/single-sign-on/troubleshooting.md)
>
> Fix sign-in, connection test and domain verification failures.

> [card] [Troubleshooting SCIM](https://docs.sazabi.com/guides/administer/single-sign-on/scim-troubleshooting.md)
>
> Read SCIM status codes and fix provisioning failures.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.