Single sign-on
Learn how to set up SSO for your Attio workspace.
Available on enterprise plan.
Only admins can set up Single Sign-On.
Single Sign-On (SSO) enables Enterprise workspaces to manage user access through their identity provider using SAML. This setup streamlines authentication by allowing users to log in with their existing company credentials, while giving admins centralized control over who can access Attio.
Note: To automate member provisioning and deprovisioning, see Provision users and teams with SCIM.
Enable Single Sign-On (SSO)
SSO (Single Sign-On) can be set up in Attio by a workspace admin following these steps:
Navigate to the Security page:
Click on your workspace name.
Select Workspace settings from the dropdown.
Click Security in the sidebar.
Verify your domains
By Domain verification, click + Add domain and verify each of the domains you wish SAML to apply to. Learn more about verifying domains.
3. Enable SSO
Once your domain(s) are verified, click the toggle by Enable single sign-on. This will reveal the SAML configuration options.
Enable Require SSO for sign-in to only allow users to sign in through your identity provider, or disable to also allow users to Sign in with Google. Either way, users cannot sign in with a temporary password while SSO is enabled.
Note: Enabling Require SSO for sign-in doesn't sign out anyone who is already logged in. It applies the next time each user signs in.
4. Configure your IdP (Identity Provider)
To set up SAML within your IdP, you will need to create a new app for Attio. As part of this setup, the IdP will typically ask for several URLs. These may be labeled differently depending on the provider, but often include:
Entity ID or Identifier
Reply URL
Assertion Consumer Service (ACS) URL
For all of these fields, use the following format: https://app.attio.com/{workspace.slug}/saml_login
Replace {workspace.slug} with your actual workspace slug. For example, if your workspace slug is acme, the URL would be:
https://app.attio.com/acme/saml_login.
5. Complete the SAML configuration in Attio
In Attio, click Configure under Single sign-on (SSO).
Enter your identity provider sign-in URL.
Upload your identity provider’s Security certificate (X.509).
Copy your Attio SSO URL and add it to your identity provider configuration.
Make sure your identity provider sends the user’s email address as the NameID, as Attio uses this to match users to accounts.
Frequently asked questions
You only need to set up SSO once. In Attio, users log in to the app itself rather than to a specific workspace. Once SSO is configured for your domain, any user with that domain can log in and access all of the workspaces they’re a member of.
This means you don’t have to configure SSO separately for each workspace. The login method is determined by the user’s email domain, so a single setup ensures that SSO works across all workspaces under that domain.
If someone is a member of multiple workspaces using the same domain, logging in with SSO will take them first to the workspace where SSO was set up. From there, they can manually switch to any of their other workspaces.
The way this works depends on whether the new email uses the same domain as the one currently associated with your account.
SSO in Attio is enforced at the domain level, not the individual email address. If your workspace has SSO enabled for examplecorp.com, any email ending in @examplecorp.com will continue to log in via SSO. Changing your email from [email protected] to [email protected], for example, does not require any changes to your SSO setup and you can update the email directly in Attio.
If you change your email to a different domain, such as [email protected], SSO will no longer apply because the new domain is not verified for SSO in the workspace. In that case, you will need to sign in using email and password unless the new domain is added and verified for SSO.
Yes. SSO applies only to the domains you've verified, so verify the domains you want it to cover and leave the others unverified.
Users on a verified domain sign in through your identity provider, or with Google if Require SSO for sign-in is disabled. Users on any other domain can sign in with a temporary password or with Google, and Require SSO for sign-in doesn't change that.
If you verify both domains on the same workspace, SSO applies to both. There's no way to verify a domain and then exclude it from SSO. Learn more about verifying a domain.