Configure SSO (SAML 2.0 or OIDC) for your OneSignal organization so team members authenticate through your identity provider.
SSO is available on Enterprise plans or with the Legal & Security package upgrade. Contact your account manager or support@onesignal.com to get started. Having a product owner for SSO on setup calls helps streamline the process.
Single Sign-On lets team members log in to OneSignal using your organization’s identity provider (IdP) instead of a separate username and password. After authenticating once through your IdP, the user receives a token that grants access to OneSignal and your other SaaS applications without additional sign-in prompts.
The email domains to enable for SSO. Domains must match exactly (onesignal.com won’t cover onesignal.net). You can register multiple domains.
Email addresses of any pilot users to test with first. They must already be members of your organization.
Support will send you a setup link once everything is confirmed.
2
Configure your identity provider
Open the setup link in your browser. Click Configure Identity Provider, select your provider from the list, and follow the on-screen instructions.
Configure your identity provider from the setup link
Select your identity provider from the list
3
Test with pilot users
Pilot users can sign in using the Continue with Single Sign-On option on the login page. Username and password login stays active for everyone else during this period.
OneSignal sign-in page with SSO option
4
Go live
When you are ready, let support know. You can go live immediately or set a future date. Once SSO is live, all users sign in through your identity provider and username and password login is disabled.
Once SSO is live, you add new team members by inviting them from the OneSignal dashboard. An org admin sends the invite, the user accepts it, and then they sign in through your identity provider. There’s no limit on the number of users in an SSO organization.
The user’s email domain must be one of the domains registered for your SSO organization. See Domain requirements below.
1
Admin invites the user
Go to Team Members, click Invite to Organization, enter the user’s email address, and assign their role. See Team Members for role options and permissions.
Team Members page with Invite to Organization button
Enter the email address to invite
2
User accepts the invitation
The user receives an email with an Accept invitation link and clicks it.
Invitation email sent to the new team member
3
User signs in with SSO
After accepting, the user signs in through your organization’s identity provider. They now have access to OneSignal.
SSO maps email domains to your organization. For example, onesignal.com covers every @onesignal.com address. An organization can register multiple domains, so you can cover several email domains under the same SSO setup.The user’s email domain must be registered under your SSO organization. If you invite someone whose domain is not registered, the invite fails with an error. To add a new domain, contact support@onesignal.com.
Error when inviting a user outside your SSO organization's domain
Add and remove users from the Team Members page in the OneSignal dashboard. Provisioning and de-provisioning directly through your IdP is not currently supported.
Yes. Access is controlled at two levels, and both must grant access:
Identity provider: Most IdPs (Okta, Google Workspace, Microsoft Entra ID, etc.) let you assign the OneSignal app to specific users, groups, or organizational units.
OneSignal invite: Users must also be invited to your organization. Authenticating through your IdP alone is not enough.
Can I use SSO and password login at the same time?
Mixed mode isn’t officially supported. SSO is meant to be the primary login method. As a workaround, you can split apps into two organizations (one with SSO, one without). Since organizations also affect billing, contact support to plan this.
