# Single sign-on

URL: https://attio.com/help/reference/workspace-settings-billing/security/single-sign-on
Breadcrumbs: [Help](https://attio.com/help) > [Reference](https://attio.com/help/reference) > [Workspace settings & billing](https://attio.com/help/reference/workspace-settings-billing) > [Security](https://attio.com/help/reference/workspace-settings-billing/security)

Learn how to set up SSO for your Attio workspace.

> Available on enterprise plans.
>
> Only **admins** can set up Single Sign-On.

Single Sign-On (SSO) enables Enterprise workspaces to manage user access through their identity provider using SAML. This setup streamlines authentication by allowing users to log in with their existing company credentials, while giving admins centralized control over who can access Attio.

> **Note: **To automate member provisioning and deprovisioning, see [Provision users and teams with SCIM](https://attio.com/help/reference/workspace-settings-billing/security/provision-users-and-teams-with-scim).

## Enable Single Sign-On (SSO)

SSO (Single Sign-On) can be set up in Attio by a workspace admin following these steps:

1. Navigate to the **Security** page:

   - Click on your workspace name.
   - Select **Workspace settings** from the dropdown.
   - Click **Security** in the sidebar.
2. **Verify your domains**

   - By **Domain verification**, click **+ Add domain** and verify each of the domains you wish SAML to apply to. Learn more about [verifying domains](https://attio.com/help/reference/workspace-settings-billing/security/verify-a-domain).

3. **Enable SSO**

- Once your domain(s) are verified, click the toggle by **Enable single sign-on**. This will reveal the SAML configuration options.
- Enable **Require SSO for sign-in** to only allow users to sign in through your identity provider, or disable to also allow users to **Sign in with Google**. Either way, users cannot sign in with a temporary password while SSO is enabled.

> **Note:** Enabling **Require SSO for sign-in** doesn't sign out anyone who is already logged in. It applies the next time each user signs in.

![Single sign-on settings with toggles for enabling and requiring SSO](https://a.storyblok.com/f/234930/1686x464/8bf9558396/enable-require-sso.png)

4. **Configure your IdP (Identity Provider)**  
To set up SAML within your IdP, you will need to create a new app for Attio. As part of this setup, the IdP will typically ask for several URLs. These may be labeled differently depending on the provider, but often include:

- **Entity ID** or **Identifier**
- **Reply URL**
- **Assertion Consumer Service (ACS) URL**

For all of these fields, use the following format: `https://app.attio.com/{workspace.slug}/saml_login`

Replace `{workspace.slug}` with your actual workspace slug. For example, if your workspace slug is `acme`, the URL would be:

`https://app.attio.com/acme/saml_login`.

5. **Complete the SAML configuration in Attio**

- In Attio, click **Configure** under **Single sign-on (SSO)**.
- Enter your **identity provider sign-in URL**.
- Upload your identity provider’s **Security certificate (X.509)**.
- Copy your **Attio SSO URL** and add it to your identity provider configuration.

Make sure your identity provider sends the user’s email address as the NameID, as Attio uses this to match users to accounts.

![SSO configuration window for inputting provider URL and uploading security certificate](https://a.storyblok.com/f/234930/1412x957/7ed8792927/sso-config.png)

## FAQ

### How can I configure SSO for multiple workspaces with the same domain?

You only need to set up SSO once. In Attio, users log in to the app itself rather than to a specific workspace. Once SSO is configured for your domain, any user with that domain can log in and access all of the workspaces they’re a member of.

This means you don’t have to configure SSO separately for each workspace. The login method is determined by the user’s email domain, so a single setup ensures that SSO works across all workspaces under that domain.

If someone is a member of multiple workspaces using the same domain, logging in with SSO will take them first to the workspace where SSO was set up. From there, they can [manually switch to any of their other workspaces](https://attio.com/help/reference/productivity-collaborating/navigating-your-workspace#switching-workspaces#switching-workspaces).

### How do I change my Attio email address if my workspace uses SSO?

The way this works depends on whether the new email uses the same domain as the one currently associated with your account.

SSO in Attio is enforced at the domain level, not the individual email address. If your workspace has SSO enabled for examplecorp.com, any email ending in @examplecorp.com will continue to log in via SSO. Changing your email from alex.jones@examplecorp.com to alex.smith@examplecorp.com, for example, does not require any changes to your SSO setup and you can update the email directly in Attio.

If you change your email to a different domain, such as alex.jones@samplemail.com, SSO will no longer apply because the new domain is not verified for SSO in the workspace. In that case, you will need to sign in using email and password unless the new domain is added and verified for SSO.

### Can I enable SSO for one domain but not another?

Yes. SSO applies only to the domains you've verified, so verify the domains you want it to cover and leave the others unverified.

Users on a verified domain sign in through your identity provider, or with Google if **Require SSO for sign-in** is disabled. Users on any other domain can sign in with a temporary password or with Google, and **Require SSO for sign-in** doesn't change that.

If you verify both domains on the same workspace, SSO applies to both. There's no way to verify a domain and then exclude it from SSO. Learn more about [verifying a domain](https://attio.com/help/reference/workspace-settings-billing/security/verify-a-domain).