> For the complete documentation index, see [llms.txt](https://docs.archera.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.archera.ai/help-center/sign-in-and-security/single-sign-on-sso.md).

# Single Sign-On (SSO)

Archera supports enterprise Single Sign-On so your team can sign in with your existing identity provider. SSO is powered by [WorkOS](https://workos.com/docs/sso) and supports both SAML and OIDC connections with all major providers, including Okta, Microsoft Entra ID (Azure AD), Google Workspace, and OneLogin.

{% hint style="info" %}
Setting up SSO requires the **Organization → write** permission. Most organization administrators have this. If the SSO controls are greyed out, ask an administrator to make the change.
{% endhint %}

## Set Up an SSO Connection

{% stepper %}
{% step %}

#### Open SSO settings

Go to [Settings → SSO](https://app.archera.ai/settings?tab=sso) in Archera.
{% endstep %}

{% step %}

#### Add a configuration

In the **SSO Configurations** section, click **Add SSO Configuration**.
{% endstep %}

{% step %}

#### Enter connection details

* **Connection name** (optional) — a label to help you identify this connection later.
* **Domains** (required) — the email domain(s) whose users should sign in through SSO. Separate multiple domains with commas. Your organization's domain is pre-filled. Any user with a matching email domain will be routed to SSO when they sign in.
  {% endstep %}

{% step %}

#### Finish setup in the WorkOS portal

When you submit, Archera creates the connection and opens the **WorkOS admin portal** in a new tab. Follow the instructions there to connect your identity provider — choose SAML or OIDC, exchange metadata or certificates, and map user attributes.
{% endstep %}
{% endstepper %}

The connection is active once it is enabled, its domain matches the user's email, and setup is complete in the WorkOS portal. There is no separate activation or in-app test step.

{% hint style="info" %}
For step-by-step setup with a specific provider, see [Configure SSO for Azure AD](/help-center/sign-in-and-security/how-do-i-configure-sso-for-azure-ad.md). Instructions for Okta, Google Workspace, and other providers are shown inside the WorkOS admin portal during setup.
{% endhint %}

## Manage a Connection

Each connection in the **SSO Configurations** list has an options menu:

* **Manage** — reopens the WorkOS admin portal to change provider settings.
* **Enable / Disable** — turn the connection on or off. Disabled connections are marked accordingly.
* **Delete** — remove the connection (this also removes it in WorkOS).

{% hint style="warning" %}
Domains cannot be edited in Archera after a connection is created — the in-app menu only offers Manage, Enable/Disable, and Delete. To change domains or provider details, use **Manage** to edit in the WorkOS portal, or delete the connection and create a new one.
{% endhint %}

## Require SSO for All Users (SSO Only)

At the top of the SSO tab, **SSO General Settings** includes an **SSO Only** toggle: *"Require all users to authenticate via SSO."* Turning it on disables email/password login and forces users to sign in through SSO.

{% hint style="warning" %}
Enable **SSO Only** only after you have confirmed SSO works for your team. Note that SSO Only applies to users whose account belongs to a single organization; a user who is a member of more than one organization is not forced through SSO by this setting.
{% endhint %}

## Related Resources

* [Signing In to Archera](/help-center/sign-in-and-security/signing-in-to-archera.md)
* [Configure SSO for Azure AD](/help-center/sign-in-and-security/how-do-i-configure-sso-for-azure-ad.md)
* [Settings & Integrations - Section Overview](/help-center/user-guide/settings-integrations.md)

Questions or issues during setup? Reach out to <support@archera.ai>.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.archera.ai/help-center/sign-in-and-security/single-sign-on-sso.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.