Ask more from CRM. Ask Attio.

Single sign-on

Learn how to set up SSO for your Attio workspace.

Table of Contents

Available on enterprise plan.

Only admins can set up Single Sign-On.

Single Sign-On (SSO) enables Enterprise workspaces to manage user access through their identity provider using SAML. This setup streamlines authentication by allowing users to log in with their existing company credentials, while giving admins centralized control over who can access Attio.

Enable Single Sign-On (SSO)

SSO (Single Sign-On) can be set up in Attio by a workspace admin following these steps:

  1. Navigate to the Security page:

    • Click on your workspace name.

    • Select Workspace settings from the dropdown.

    • Click Security in the sidebar.

  2. Verify your domains

    • By Domain verification, click + Add domain and verify each of the domains you wish SAML to apply to.

    • For example, if you want attio.com to be protected by your SAML provider (such as Okta), you must verify attio.com using the DNS challenge method.

After adding a domain, click the ⋮ icon to its right to access additional options:

  • Show DNS details: View the DNS records used to verify the domain.

  • Restrict email edits: Prevent workspace members with an email on this domain from changing their login email. When enabled, affected members won't see the option to edit their email on their profile page.

  • Remove: Delete the domain from your workspace.

3. Enable SAML

  • Once your domain(s) are verified, click the toggle by Enable single sign-on. This will reveal the SAML configuration options.

  • Enable Require SSO for sign-in to only allow users to sign in through your identity provider, or disable to allow other sign-in methods.

4. Configure your IdP (Identity Provider)
To set up SAML within your IdP, you will need to create a new app for Attio. As part of this setup, the IdP will typically ask for several URLs. These may be labeled differently depending on the provider, but often include:

  • Entity ID or Identifier

  • Reply URL

  • Assertion Consumer Service (ACS) URL

For all of these fields, use the following format: https://app.attio.com/{workspace.slug}/saml_login

Replace {workspace.slug} with your actual workspace slug. For example, if your workspace slug is acme, the URL would be:

https://app.attio.com/acme/saml_login.

5. Complete the SAML configuration in Attio

  • In Attio, click Configure under Single sign-on (SSO).

  • Enter your identity provider sign-in URL.

  • Upload your identity provider’s Security certificate (X.509).

  • Copy your Attio SSO URL and add it to your identity provider configuration.

Make sure your identity provider sends the user’s email address as the NameID, as Attio uses this to match users to accounts.

Frequently asked questions