Owners and admins set this up under Settings → Single sign-on.
1. Create the app in your identity provider
Create a SAML 2.0 application and paste the ACS URL and Entity ID we show, or point your provider at our metadata URL. Send the user's email as the Name ID or as an email attribute.
2. Add the provider here
Paste your provider's metadata URL (recommended, certificate changes are picked up automatically), its metadata XML, or the sign-on URL, entity ID and certificate.
3. Verify your email domains
Add the domains your team uses and publish the TXT record we show for each. SSO only signs in addresses on verified domains, which prevents anyone from using a provider to sign in as someone else.
4. Test, then turn it on
Use Test login to make sure everything works. Optionally create accounts automatically for new people from your domains, with the role you choose.
Require SSO
After a successful test you can require SSO for all members. Owners can still sign in with their password, in case your identity provider has an outage.