> For the complete documentation index, see [llms.txt](https://docs.roboflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.roboflow.com/workspaces/single-sign-on-sso.md).

# Single Sign On (SSO)

{% hint style="info" %}
Single Sign On (SSO) is a **premium** feature, only available for Enterprise.

For up-to-date information on our plans and their associated features, see our pricing page.
{% endhint %}

Enterprise customers can request Single Sign On authentication.

This is useful if you have enterprise authentication requirements around using software with SSO.

To learn more about Single Sign On, contact the [Roboflow sales team](https://roboflow.com/sales) or your account representative.

## Setup

### Before you start

\- Workspace Admin role access.

\- SSO enabled on your workspace by [Roboflow](https://roboflow.com/sales).

\- Access to your DNS provider for domain verification

### Step 1 - Verify your domain

\- Go to Settings → Members and Roles → SSO.

\- Click Verify domain → the SSO setup portal opens → add your email domain → copy the TXT record → add it at your DNS

<figure><img src="/files/eYLFrUA7C2VHmrJsG1GO" alt=""><figcaption></figcaption></figure>

\- Multiple domains are supported.

### Step 2 - Connect your identity provider

\- Once at least one domain is Verified, Set up SSO becomes clickable.

\- Click Set up SSO → the SSO setup portal opens on the connection page → pick SAML or OIDC and follow the provider-specific wizard.

### Step 3 - Test your first sign-in

\- Sign out of Roboflow.

\- Go to app.roboflow\.com, enter a work email on a verified domain.

\- Confirm you're redirected to your identity provider.

## Signing In with SSO

The Roboflow login page includes a "Continue with SSO" button alongside the Google, GitHub, and Email sign-in options. To sign in with SSO:

1. Click "Continue with SSO" on the login page.
2. Enter your work email address.
3. If your email domain has SSO configured, you are redirected to your organization's identity provider to complete authentication.

If your domain does not have SSO configured, an inline error is displayed. Contact your workspace admin or the [Roboflow sales team](https://roboflow.com/sales) to set up SSO for your organization.

## SSO Profile-Based Authorization Groups

Enterprise customers using SSO can configure **authorization group attributes** to automatically assign users to Roboflow authorization groups based on their identity provider (IdP) profile attributes, such as Active Directory (AD) group memberships.

When a user signs in via SSO, Roboflow reads the specified attributes from the SSO profile's `sign_in_attributes` and maps them to Roboflow authorization groups. This allows you to manage access control through your IdP rather than manually assigning groups in Roboflow.

## Workspace Access Gating by AD Group

Enterprise SSO environments support per-workspace access gating based on AD group membership. Each allowed workspace in your SSO environment can be configured with:

* **Required AD Groups**: Only users who belong to at least one of the specified AD groups can access the workspace. Users who no longer meet the requirement lose access on their next sign-in.
* **Auto-join**: When enabled, users who meet the required AD groups (or all SSO users, if no groups are configured) are automatically added to the workspace on sign-in, without needing an invite.

These options can be combined per workspace:

| Required AD Groups | Auto-join | Behavior                                                                     |
| ------------------ | --------- | ---------------------------------------------------------------------------- |
| Not set            | Off       | Default: admin must invite users manually                                    |
| Not set            | On        | All SSO users are auto-added to the workspace                                |
| Set                | Off       | Existing members who don't match are removed; new users still need an invite |
| Set                | On        | Matching users are auto-added; non-matching members are removed              |

{% hint style="info" %}
Roboflow admins are exempt from AD group gating and always retain workspace access. The default workspace for the SSO environment is never gated.
{% endhint %}

AD group membership is refreshed each time a user signs in through your IdP. If a user is removed from a required AD group in your IdP, they will lose access to gated workspaces on their next Roboflow sign-in.

To configure workspace access gating, contact the [Roboflow sales team](https://roboflow.com/sales) or your account representative.

## Custom Role Mapping via SSO Groups

If your workspace has [Custom Roles](/workspaces/team-members/role-based-access-control.md#custom-roles) enabled, you can map identity provider groups to custom roles. When a user signs in via SSO, Roboflow assigns the custom roles whose mapped groups match the user's identity provider group memberships.

Roles that have SSO group mappings are reconciled on each sign-in:

* Roles with matching groups are assigned automatically.
* Roles whose mapped groups no longer match the user are removed.
* Roles without any SSO group mapping (manually assigned roles) are preserved and not affected by SSO sync.

If a member loses all of their group-mapped roles and has no manually assigned roles, they are assigned the workspace's default role instead.

Members can hold multiple custom roles at once if their identity provider groups match more than one mapped role. The workspace Members page displays all of a member's current roles.

For custom roles with SSO group mapping, you can also enable a [Super User](/workspaces/team-members/role-based-access-control.md#super-user-roles) flag to grant full workspace access through that role.

## Custom Branding

Enterprise SSO environments support custom branding so your Roboflow experience matches your organization's visual identity. Admins can configure branding through the SSO admin panel without engineering involvement.

Customizable elements include:

* **Login screen**: Organization logo, logo size, accent color, card background and border colors, button color, and Roboflow wordmark color.
* **Sidebar navigation**: Background hover color, text and icon colors for selected and unselected states, and logo border color.

Changes take effect immediately for all users in your SSO environment. Users outside your SSO environment are not affected.

To set up custom branding, contact the [Roboflow sales team](https://roboflow.com/sales) or your account representative.