Orchestrate revenue agents with Workflows

Single sign-on

Learn how to set up SSO for your Attio workspace.

Table of Contents

Available on enterprise plan.

Only admins can set up Single Sign-On.

Single Sign-On (SSO) enables Enterprise workspaces to manage user access through their identity provider using SAML. This setup streamlines authentication by allowing users to log in with their existing company credentials, while giving admins centralized control over who can access Attio.

Note: To automate member provisioning and deprovisioning, see Provision users and teams with SCIM.

Enable Single Sign-On (SSO)

SSO (Single Sign-On) can be set up in Attio by a workspace admin following these steps:

  1. Navigate to the Security page:

    • Click on your workspace name.

    • Select Workspace settings from the dropdown.

    • Click Security in the sidebar.

  2. Verify your domains

    • By Domain verification, click + Add domain and verify each of the domains you wish SAML to apply to. Learn more about verifying domains.

3. Enable SSO

  • Once your domain(s) are verified, click the toggle by Enable single sign-on. This will reveal the SAML configuration options.

  • Enable Require SSO for sign-in to only allow users to sign in through your identity provider, or disable to also allow users to Sign in with Google. Either way, users cannot sign in with a temporary password while SSO is enabled.

Note: Enabling Require SSO for sign-in doesn't sign out anyone who is already logged in. It applies the next time each user signs in.

4. Configure your IdP (Identity Provider)
To set up SAML within your IdP, you will need to create a new app for Attio. As part of this setup, the IdP will typically ask for several URLs. These may be labeled differently depending on the provider, but often include:

  • Entity ID or Identifier

  • Reply URL

  • Assertion Consumer Service (ACS) URL

For all of these fields, use the following format: https://app.attio.com/{workspace.slug}/saml_login

Replace {workspace.slug} with your actual workspace slug. For example, if your workspace slug is acme, the URL would be:

https://app.attio.com/acme/saml_login.

5. Complete the SAML configuration in Attio

  • In Attio, click Configure under Single sign-on (SSO).

  • Enter your identity provider sign-in URL.

  • Upload your identity provider’s Security certificate (X.509).

  • Copy your Attio SSO URL and add it to your identity provider configuration.

Make sure your identity provider sends the user’s email address as the NameID, as Attio uses this to match users to accounts.

Frequently asked questions