> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.onesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On (SSO)

> Configure SSO (SAML 2.0 or OIDC) for your OneSignal organization so team members authenticate through your identity provider.

<Note>
  SSO is available on Enterprise plans or with the Legal & Security package upgrade. Contact your account manager or `support@onesignal.com` to get started. Having a product owner for SSO on setup calls helps streamline the process.
</Note>

## What is SSO?

Single Sign-On lets team members log in to OneSignal using your organization's identity provider (IdP) instead of a separate username and password. After authenticating once through your IdP, the user receives a token that grants access to OneSignal and your other SaaS applications without additional sign-in prompts.

## Supported identity providers

OneSignal supports **SAML 2.0** and **OpenID Connect (OIDC)**. Use whichever your IdP supports. The SSO experience is the same.

<Accordion title="View supported identity providers">
  |                                                                                                                     |                                                                                                                                                            |                                                                                                                                                |
  | ------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
  | [ADP](https://marketplace.adp.com/downloads/setting-up-sso.pdf)                                                     | [Duo](https://duo.com/docs/sso)                                                                                                                            | [OneLogin](https://www.onelogin.com/blog/saml-configuration)                                                                                   |
  | [Auth0](https://auth0.com/docs/get-started/applications/enable-sso-for-applications)                                | [Google Workspace](https://support.google.com/a/answer/12032922?hl=en)                                                                                     | [Oracle](https://docs.oracle.com/en/cloud/paas/content-cloud/administer/enable-single-sign-sso.html#GUID-8C87B98B-362E-4AD4-8AB9-BD7057935AFE) |
  | [Microsoft Entra ID (Azure AD)](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso) | [JumpCloud](https://support.jumpcloud.com/support/s/article/getting-started-applications-saml-sso2)                                                        | PingFederate                                                                                                                                   |
  | CAS                                                                                                                 | Keycloak                                                                                                                                                   | PingOne                                                                                                                                        |
  | ClassLink                                                                                                           | [LastPass](https://support.lastpass.com/s/document-item?language=en_US\&bundleId=lastpass\&topicId=LastPass/c_lastpass_admins_toolkit_sso.html&_LANG=enus) | [Rippling](https://developer.rippling.com/docs/rippling-api/dii48ovix1887-saml-sso-guide)                                                      |
  | [Cloudflare](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/)                            | [Microsoft ADFS](https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/active-directory/set-up-adfs-for-single-sign-on)                             | [Salesforce](https://help.salesforce.com/s/articleView?id=sf.sso_about.htm\&type=5)                                                            |
  | Custom OpenID Connect                                                                                               | miniOrange                                                                                                                                                 | Shibboleth                                                                                                                                     |
  | Custom SAML                                                                                                         | NetIQ                                                                                                                                                      | Shibboleth Unsolicited                                                                                                                         |
  | [CyberArk](https://docs.cyberark.com/Idaptive/Latest/en/Content/Applications/AppsOvw/ConfigSSO.htm)                 | [Okta](https://developer.okta.com/docs/guides/build-sso-integration/openidconnect/main/)                                                                   | SimpleSAMLphp                                                                                                                                  |
  |                                                                                                                     |                                                                                                                                                            | [VMware](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-75D4E587-3F9B-4B50-96DA-D6DB6D1781D7.html)                      |

  If your IdP is not listed, contact `support@onesignal.com` to request it.
</Accordion>

***

## Setup

* **Eligibility**: Enterprise plans and the Legal & Security package.
* **Who sets it up**: The person configuring SSO, who must also be a OneSignal org admin.

### Steps

<Steps>
  <Step title="Contact support with your details">
    Email `support@onesignal.com` with the following:

    * Your OneSignal org name and org ID.
    * The email domains to enable for SSO. Domains must match exactly (`onesignal.com` won't cover `onesignal.net`). You can register multiple domains.
    * Email addresses of any pilot users to test with first. They must already be members of your organization.

    Support will send you a setup link once everything is confirmed.
  </Step>

  <Step title="Configure your identity provider">
    Open the setup link in your browser. Click **Configure Identity Provider**, select your provider from the list, and follow the on-screen instructions.

    <Frame caption="Configure your identity provider from the setup link">
      <img src="https://mintcdn.com/onesignal/Kz3Ri9HQkOKvyy5K/images/docs/sso-configure-identity-provider.png?fit=max&auto=format&n=Kz3Ri9HQkOKvyy5K&q=85&s=1d0d093ed1b581d72186a6f531ec4266" alt="OneSignal SSO setup page with a Configure Identity Provider button and the setup link" width="1024" height="561" data-path="images/docs/sso-configure-identity-provider.png" />
    </Frame>

    <Frame caption="Select your identity provider from the list">
      <img src="https://mintcdn.com/onesignal/Kz3Ri9HQkOKvyy5K/images/docs/sso-select-identity-provider.png?fit=max&auto=format&n=Kz3Ri9HQkOKvyy5K&q=85&s=11cd3091c2c3e6b48ae990ada8769140" alt="OneSignal SSO provider selection screen with a search box and a list of identity providers such as Okta, Entra ID, Google, and ADP" width="1024" height="950" data-path="images/docs/sso-select-identity-provider.png" />
    </Frame>
  </Step>

  <Step title="Test with pilot users">
    Pilot users can sign in using the **Continue with Single Sign-On** option on the login page. Username and password login stays active for everyone else during this period.

    <Frame caption="OneSignal sign-in page with SSO option">
      <img src="https://mintcdn.com/onesignal/KSCNwSpBCNSQ8xdF/images/docs/f7d3f9c-signin.png?fit=max&auto=format&n=KSCNwSpBCNSQ8xdF&q=85&s=4ff34c990fa5380e8f263c1414d19ff2" alt="OneSignal sign-in page showing the Continue with Single Sign-On button alongside username and password fields" width="856" height="984" data-path="images/docs/f7d3f9c-signin.png" />
    </Frame>
  </Step>

  <Step title="Go live">
    When you are ready, let support know. You can go live immediately or set a future date. Once SSO is live, all users sign in through your identity provider and username and password login is disabled.
  </Step>
</Steps>

***

## Add users to your SSO organization

Once SSO is live, you add new team members by inviting them from the OneSignal dashboard. An org admin sends the invite, the user accepts it, and then they sign in through your identity provider. There's no limit on the number of users in an SSO organization.

<Note>
  The user's email domain must be one of the domains registered for your SSO organization. See [Domain requirements](#domain-requirements) below.
</Note>

<Steps>
  <Step title="Admin invites the user">
    Go to **Team Members**, click **Invite to Organization**, enter the user's email address, and assign their role. See [Team Members](./manage-team-members) for role options and permissions.

    <Frame caption="Team Members page with Invite to Organization button">
      <img src="https://mintcdn.com/onesignal/Z6xkXGfmy814If53/images/docs/d930dcf883e3134f1a688d4b94bb9976d447e70c55da9f4efdea7182ee37bada-Screenshot_2024-12-04_at_3.25.08_PM.png?fit=max&auto=format&n=Z6xkXGfmy814If53&q=85&s=ee79b4a6896baa1487096cfcf6b753b1" alt="OneSignal Team Members page showing the Invite to Organization button" width="2822" height="1026" data-path="images/docs/d930dcf883e3134f1a688d4b94bb9976d447e70c55da9f4efdea7182ee37bada-Screenshot_2024-12-04_at_3.25.08_PM.png" />
    </Frame>

    <Frame caption="Enter the email address to invite">
      <img src="https://mintcdn.com/onesignal/MUgio66t0sYhGEvj/images/docs/6f6bc0b-adding_person_to_app.png?fit=max&auto=format&n=MUgio66t0sYhGEvj&q=85&s=a081dd660c2ec2794a95f28e1f3ebff3" alt="Email input form for adding a team member to the OneSignal organization" width="660" height="350" data-path="images/docs/6f6bc0b-adding_person_to_app.png" />
    </Frame>
  </Step>

  <Step title="User accepts the invitation">
    The user receives an email with an **Accept invitation** link and clicks it.

    <Frame caption="Invitation email sent to the new team member">
      <img src="https://mintcdn.com/onesignal/KSCNwSpBCNSQ8xdF/images/docs/f7c4d0c-invite-email.png?fit=max&auto=format&n=KSCNwSpBCNSQ8xdF&q=85&s=d9dd9c8bd0e6a2e8393cfcf5013ca3bb" alt="OneSignal invitation email with Accept invitation button" width="900" height="674" data-path="images/docs/f7c4d0c-invite-email.png" />
    </Frame>
  </Step>

  <Step title="User signs in with SSO">
    After accepting, the user signs in through your organization's identity provider. They now have access to OneSignal.

    <Frame caption="SSO login page after accepting the invitation">
      <img src="https://mintcdn.com/onesignal/YOTSrtBSoqdrJ37A/images/docs/47c7434-login_to_sso.png?fit=max&auto=format&n=YOTSrtBSoqdrJ37A&q=85&s=8e6392b319a32ac40bbb6b18f01a6a99" alt="OneSignal SSO login page prompting the user to authenticate through their identity provider" width="700" height="544" data-path="images/docs/47c7434-login_to_sso.png" />
    </Frame>
  </Step>
</Steps>

### Domain requirements

SSO maps email domains to your organization. For example, `onesignal.com` covers every `@onesignal.com` address. An organization can register multiple domains, so you can cover several email domains under the same SSO setup.

The user's email domain must be registered under your SSO organization. If you invite someone whose domain is not registered, the invite fails with an error. To add a new domain, contact `support@onesignal.com`.

<Frame caption="Error when inviting a user outside your SSO organization's domain">
  <img src="https://mintcdn.com/onesignal/Z6xkXGfmy814If53/images/docs/d80d5d6-adding_person_to_app.png?fit=max&auto=format&n=Z6xkXGfmy814If53&q=85&s=437d5dbc5f292562f76aa9158b195785" alt="OneSignal error message shown when inviting a user whose email domain is not registered in the SSO organization" width="660" height="498" data-path="images/docs/d80d5d6-adding_person_to_app.png" />
</Frame>

***

## FAQ

### How do I add or remove users?

Add and remove users from the [Team Members](./manage-team-members) page in the OneSignal dashboard. Provisioning and de-provisioning directly through your IdP is not currently supported.

### Can I limit who can sign in with SSO?

Yes. Access is controlled at two levels, and both must grant access:

1. **Identity provider**: Most IdPs (Okta, Google Workspace, Microsoft Entra ID, etc.) let you assign the OneSignal app to specific users, groups, or organizational units.
2. **OneSignal invite**: Users must also be [invited to your organization](./manage-team-members). Authenticating through your IdP alone is not enough.

### Can I use SSO and password login at the same time?

Mixed mode isn't officially supported. SSO is meant to be the primary login method. As a workaround, you can split apps into two organizations (one with SSO, one without). Since organizations also affect billing, contact support to plan this.

### What happens if my IdP goes down?

Users with an active session can keep working. Users who need to sign in can't until the IdP is restored.

### Can I connect more than one IdP?

No. Each organization supports one IdP.

***

<Columns cols={2}>
  <Card title="Team Members" icon="users" href="./manage-team-members">
    Invite users, assign roles, and manage permissions across your organization.
  </Card>

  <Card title="Pricing" icon="credit-card" href="https://onesignal.com/pricing">
    Compare plans and see which features are included at each tier.
  </Card>
</Columns>