> ## Documentation Index > Fetch the complete documentation index at: https://docs.openference.com/llms.txt > Use this file to discover all available pages before exploring further. # Single sign-on and provisioning > Let your team sign in with Okta, Microsoft Entra ID, Google Workspace or any OpenID Connect provider, and add or remove people automatically with SCIM. # Single sign-on and provisioning Team owners can connect their company identity provider so members sign in with their work account instead of a separate password, and so IT can add and remove people from one place. Both features are included with every team at no extra cost. * **Single sign-on (SSO)** uses OpenID Connect and works with Okta, Microsoft Entra ID, Google Workspace and other standards-compliant providers. * **Directory provisioning (SCIM 2.0)** lets your identity provider create and deactivate people automatically. SAML is not available yet. ## Before you start 1. You must be the team **owner**. SSO and provisioning are owner-only settings. 2. Verify your company email domain in **Team → Settings** (a DNS TXT record). SSO only signs in email addresses on that domain, and it is turned off automatically if the verified domain is removed or changed. ## Set up single sign-on Open **Team → Settings → Single sign-on (SSO)**. ### 1. Create an app in your identity provider Create an **OpenID Connect web application** and use this redirect URI (it is also shown in the dashboard): ```text theme={null} https://openference.com/auth/sso/callback ``` Request the `openid`, `email` and `profile` scopes and use the authorization code flow. #### Okta 1. In the Okta admin console, go to **Applications → Create App Integration**. 2. Choose **OIDC - OpenID Connect**, then **Web Application**. 3. Set the **Sign-in redirect URI** to the value above and assign the people or groups who should have access. 4. Copy the **Client ID** and **Client secret**. Your **Issuer** is your Okta domain, for example `https://acme.okta.com`. #### Microsoft Entra ID 1. In the Entra admin center, go to **Applications → App registrations → New registration**. 2. Add a **Web** redirect URI with the value above. 3. Under **Certificates & secrets**, create a client secret and copy its value. 4. Copy the **Application (client) ID**. Your **Issuer** is `https://login.microsoftonline.com//v2.0`. #### Google Workspace 1. In the Google Cloud console, create an **OAuth client ID** of type **Web application** and add the redirect URI above. 2. Copy the **Client ID** and **Client secret**. 3. Your **Issuer** is `https://accounts.google.com`. ### 2. Paste the details into the dashboard Enter the **Issuer URL**, **Client ID** and **Client secret**, then choose **Save connection**. The client secret is stored encrypted and is never shown again. Two optional settings: * **Create accounts automatically** — people on your verified domain who sign in are added to the team as members. Turn this off to allow only people you have invited or provisioned. * **Session length** — how many hours a member stays signed in before they must sign in again. ### 3. Test, then enable Choose **Test sign-in** and sign in with an account on your verified domain. A successful test is required before you can enable SSO. After enabling, members can use **Continue with SSO** on the sign-in page and enter their work email, or use the direct link shown in the dashboard. ### 4. Optionally require SSO Turn on **Require SSO for this team** to make everyone open the team through your identity provider. The team **owner** can still sign in with their password so a misconfiguration never locks you out; those sign-ins are recorded in the audit log. > **Note:** API keys are not affected by SSO. Removing a member from the team revokes their team API keys immediately. ## Set up directory provisioning (SCIM) Provisioning requires an SSO connection. Open **Team → Settings → User provisioning (SCIM)**. 1. Choose **Create token** and copy it. It is shown once. You can have several active tokens, and you can revoke any of them at any time. 2. In your identity provider, add a **SCIM 2.0** provisioning connection. In Okta this is a SCIM 2.0 app with header authentication; in Microsoft Entra ID it is an enterprise application with **Provisioning** set to **Automatic**. Use these values: * **SCIM base URL** (Entra: *Tenant URL*): `https://openference.com/scim/v2` * **Authentication**: bearer token (Entra: *Secret token*), using the token you created. * **Unique identifier**: `userName` (the person's work email address). 3. Enable **Create users**, **Update user attributes** and **Deactivate users**. What provisioning does: | In your identity provider | In Openference | | - | - | | Assign a person to the app | They are authorized to sign in with SSO and join the team on first sign-in, even if automatic account creation is off. | | Deactivate or unassign a person | They are removed from the team, their team API keys are revoked and their SSO sessions end immediately. | | Delete a person | Same as deactivating, and the directory entry is removed. | | Update a name | The directory entry is updated. | Notes: * Only email addresses on your verified domain can be provisioned. * The team owner cannot be deactivated or deleted through provisioning. Transfer ownership first. * Groups are not supported yet; roles are managed in the dashboard. ## Managing access * **Sign everyone out of SSO** ends every SSO session for the team, for example after an incident. * **Remove SSO** deletes the saved connection. Members can still use their existing sign-in methods unless you removed them from the team. * Changes to SSO and provisioning (setup, test, enable, enforcement, token creation and revocation, and member deprovisioning) appear in the team [audit log](https://docs.openference.com/billing/teams.md#team-controls), which you can export as JSON or CSV. ## Troubleshooting | Message | What to check | | - | - | | *Test sign-in failed* | The issuer, client ID and secret, and that the redirect URI matches exactly. | | *Account isn't on your verified domain* | Sign in with a work address on the verified domain. | | *Your identity provider didn't share an email address* | Allow the `email` scope and make sure the user has an email set. | | *Not provisioned for this team* | Automatic account creation is off: invite the person or assign them in your identity provider with provisioning on. | | *Account deactivated* | The person is deactivated in your directory. Reactivate them there. | Still stuck? [Contact support](https://openference.com/contact). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.