Set up single sign-on

SSO lets your wider developer team sign in with the identity provider you already run —
Google Workspace, Microsoft Entra, or any generic OIDC or SAML provider. Your own admin
login is unaffected: admins keep signing in with passkeys.
The wizard
Organization SSO walks through eight steps: Provider → Overview → Configure →
Validate → Test login → Provisioning → Review → Activate. You can leave and come back;
progress is saved as a draft.
The steps that need attention:
Configure — the values from your IdP (issuer URL, client id and secret, or the SAML
metadata). The wizard shows the redirect URL to paste into your IdP.
Validate — a reachability check against the issuer before anything is saved. This
catches the common typo class (wrong tenant id, a URL that only resolves inside your
network) early rather than at first login.
Test login — you sign in through the provider for real, in a separate window. The
wizard refuses to activate until this passes.
Provisioning — decide whether a developer who authenticates successfully is admitted
automatically, or waits for an admin to approve them (Users & Teams → Developers
shows them as 
pending).
One provider at a time
Configuring a new provider replaces the existing one. The old configuration is removed
when the new one activates.
If sign-in starts failing later
The SSO page shows the configuration status (
active, 
testing, 
failing). A 
failing
state usually means a rotated client secret or an expired SAML certificate — re-run
Test login to see the provider's own error.
Organization SSO — Google, Microsoft, generic OIDC or SAML, one provider at a time.