> For the complete documentation index, see [llms.txt](https://docs.roboflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.roboflow.com/platform/enterprise-features/single-sign-on-sso.md). # Single Sign On (SSO) Set up Single Sign On (SSO) so your team signs in to Roboflow through your identity provider. {% hint style="info" %} This feature is available on the [Teams Add-On](/platform/billing-and-plans/plans/teams-add-on.md) and Enterprise workspaces. See our [pricing page](https://roboflow.com/pricing) for more info. {% endhint %} Single Sign On lets your team sign in to Roboflow through your company's identity provider. With Teams, workspace Admins set up SSO themselves from the "SSO" tab. On Enterprise, contact the [Roboflow sales team](https://roboflow.com/sales) or your account representative to turn on the "SSO" tab or to have Roboflow set up SSO for you. The sections after [Signing In with SSO](#signing-in-with-sso) cover Enterprise options. ## Setup Setup needs someone who can add DNS records for your domain and copy values (ex: Client ID, redirect URLs) into your identity provider's admin console. You need to be an Admin, or hold a role with the "Manage Single Sign-On" permission. 1. Go to Settings, click "Team Members", then open the "SSO" tab. 2. Click "Enable Single Sign-On". 3. Under "Domain Verification", click "Verify Domain". The Admin Portal opens in a new tab. Add your email domain, then add the TXT record it shows at your DNS provider. Click "Verify Another Domain" to add more domains. 4. Go back to the "SSO" tab. Each domain shows "Pending", "Verified", or "Failed". 5. When at least one domain shows "Verified", click "Set up SSO" under "Single Sign-On". In the Admin Portal, choose your identity provider and follow its steps. 6. Go back to the "SSO" tab. The "Single Sign-On" card shows "Active" once the connection works. Click "Manage SSO" to change or replace it later.
The SSO tab with the Domain Verification and Single Sign-On cards
To test it, sign out of Roboflow and [sign in with SSO](#signing-in-with-sso) using a work email on a verified domain. You should land on your identity provider's sign-in page. When someone who is not yet a member signs in with SSO, Roboflow adds them to your workspace as an Admin, or with the default role if your workspace uses [Custom Roles](/platform/enterprise-features/role-based-access-control.md#custom-roles). Change a member's role on the "Members" tab. ## Signing In with SSO The Roboflow login page includes a "Continue with SSO" button alongside the Google, GitHub, and Email sign-in options. To sign in with SSO: 1. Click "Continue with SSO" on the login page. 2. Enter your work email address. 3. If your email domain has SSO configured, you are redirected to your organization's identity provider to complete authentication. If your domain does not have SSO configured, an inline error is displayed. Contact your workspace admin or the [Roboflow sales team](https://roboflow.com/sales) to set up SSO for your organization. ## SSO Profile-Based Authorization Groups Enterprise customers using SSO can configure **authorization group attributes** to automatically assign users to Roboflow authorization groups based on their identity provider (IdP) profile attributes, such as Active Directory (AD) group memberships. When a user signs in via SSO, Roboflow reads the specified attributes from the SSO profile's `sign_in_attributes` and maps them to Roboflow authorization groups. This allows you to manage access control through your IdP rather than manually assigning groups in Roboflow. ## Account Email From a Profile Attribute Roboflow can set the account email from an IdP profile attribute other than the email claim (ex: `gevemail`). Tell your account representative the attribute name. If the value is missing, invalid, or not on your SSO email domains, the user keeps their current email. ## Workspace Access Gating by AD Group Enterprise SSO environments support per-workspace access gating based on AD group membership. Each allowed workspace in your SSO environment can be configured with: * **Required AD Groups**: Only users who belong to at least one of the specified AD groups can access the workspace. Users who no longer meet the requirement lose access on their next sign-in. * **Auto-join**: When enabled, users who meet the required AD groups (or all SSO users, if no groups are configured) are automatically added to the workspace on sign-in, without needing an invite. These options can be combined per workspace: | Required AD Groups | Auto-join | Behavior | | ------------------ | --------- | ---------------------------------------------------------------------------- | | Not set | Off | Default: admin must invite users manually | | Not set | On | All SSO users are auto-added to the workspace | | Set | Off | Existing members who don't match are removed; new users still need an invite | | Set | On | Matching users are auto-added; non-matching members are removed | {% hint style="info" %} Roboflow admins are exempt from AD group gating and always retain workspace access. The default workspace for the SSO environment is never gated. {% endhint %} AD group membership is refreshed each time a user signs in through your IdP. If a user is removed from a required AD group in your IdP, they will lose access to gated workspaces on their next Roboflow sign-in. To configure workspace access gating, contact the [Roboflow sales team](https://roboflow.com/sales) or your account representative. ## Custom Role Mapping via SSO Groups If your workspace has [Custom Roles](/platform/enterprise-features/role-based-access-control.md#custom-roles) enabled, you can map identity provider groups to custom roles. When a user signs in via SSO, Roboflow assigns the custom roles whose mapped groups match the user's identity provider group memberships. Roles that have SSO group mappings are reconciled on each sign-in: * Roles with matching groups are assigned automatically. * Roles whose mapped groups no longer match the user are removed. * Roles without any SSO group mapping (manually assigned roles) are preserved and not affected by SSO sync. If a member loses all of their group-mapped roles and has no manually assigned roles, they are assigned the workspace's default role instead. Members can hold multiple custom roles at once if their identity provider groups match more than one mapped role. The workspace Members page displays all of a member's current roles. For custom roles with SSO group mapping, you can also enable a [Super User](/platform/enterprise-features/role-based-access-control.md#super-user-roles) flag to grant full workspace access through that role. ## Auth Groups Auth groups are named sets of workspace members, so you can manage people by team instead of one at a time. Workspaces with project folder permissions get an "Auth Groups" tab under Settings. Click "Create Auth Group" to name a group and list the identity provider group names it maps to. Members you assign by hand get a "Manual" badge. Members whose identity provider groups match the mapping get an "SSO" badge, rechecked on each sign-in. ## Custom Branding Enterprise SSO environments support custom branding so your Roboflow experience matches your organization's visual identity. Admins can configure branding through the SSO admin panel without engineering involvement. Customizable elements include: * **Login screen**: Organization logo, logo size, accent color, card background and border colors, button color, and Roboflow wordmark color. * **Sidebar navigation**: Background hover color, text and icon colors for selected and unselected states, and logo border color. * Loading icon: An image that replaces the running loading animation while pages load. Use an animated GIF or WebP (PNG and JPEG also work), up to 2 MB. SVG is not supported. Workspace admins can edit branding in Settings, then "Branding". Click "Save Changes" to apply your changes, or "Discard Changes" to go back to the saved branding. Changes take effect immediately for all users in your SSO environment. Users outside your SSO environment are not affected. To set up custom branding, contact the [Roboflow sales team](https://roboflow.com/sales) or your account representative.