> For the complete documentation index, see [llms.txt](https://help.felt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.felt.com/administration/sso.md).

# SSO

Set up SAML Single Sign-On (SSO) with Okta, Google, Entra, or another identity provider. Manage required SSO login for your Felt workspace.

{% hint style="success" %}
Available on the Enterprise plan. [Talk to sales](https://felt.com/sales)
{% endhint %}

Single Sign-On (SSO) lets people on your company's email domain log in to Felt through your identity provider (IdP), so IT manages access in one place.

SSO uses the email domain of your workspace's primary admin, such as `yourcompany.com`. Each domain can belong to only one Felt workspace.

## Set up SSO

Setting up SSO needs admin access in your identity provider. It takes three stages:

1. Turn on SSO in your Felt workspace settings.
2. Connect Felt and your identity provider: copy three values from your identity provider into Felt and three from Felt into your identity provider, then set up three SAML attributes.
3. Choose your SSO settings in Felt.

### Step 1: Start SSO in Felt

1. Click your workspace name in the sidebar, then click **Workspace settings**.
2. Click the **Workspace** tab.
3. In the **Enterprise SSO** section, click **Enable SSO for @yourdomain.com**.
4. Click **Configure SAML** to confirm that you have admin access in your identity provider. A setup guide opens in a new tab.

### Step 2: Connect your identity provider

Felt's SSO uses SAML 2.0, with setup guides for Okta, Google, Microsoft Entra ID, OneLogin, JumpCloud, Duo, Rippling, and any other SAML 2.0 identity provider. The exact screens and field names vary by identity provider, so follow the guide for yours.

1. In the setup guide, select your identity provider.
2. In your identity provider, create a SAML app for Felt.
3. Enter these three values from your identity provider into the guide:
   * `SAML 2.0 Endpoint`
   * `Issuer URL / Entity ID`
   * `Certificate`
4. Enter these three values from the guide into your identity provider:
   * `ACS URL`
   * `ACS URL Validator`
   * `Audience (EntityID)`
5. In your identity provider, set up these three SAML attributes: `email`, `first_name`, and `last_name`.
6. Skip the user role step. Felt doesn't use roles from your identity provider.
7. Click **Finish**.
8. Click **Test Connection**. If it fails, see [Test Connection fails](#test-connection-fails).
9. Click **Finish & go live**.
10. Close the setup tab and go back to your Felt workspace settings.

### Step 3: Choose your SSO settings

1. Optional: Set **Require SSO login** to **On**. Everyone on your email domain must then log in through SSO, including people who already have a Felt password. Admins can always log in with their email and password, so a problem with your identity provider can't lock the workspace out.
2. Optional: Set **Automatically invite new users** to **On**. People on your email domain join the workspace on their first SSO login. Their access is set by **Default access level** in the **Joining the workspace** section. If the workspace has no seats or viewers left, they get a Felt account but don't join the workspace.
3. In your identity provider, assign the people who should use Felt to the SAML app. Only people you assign can log in with SSO.

## Log in with SSO

People log in with SSO from the Felt login page after entering their work email. When SSO login is required, Felt sends them straight to your identity provider. Otherwise, they can click **Log in with SSO** or use their password.

For other ways to log in, see [Account and login](/getting-started/account-and-login.md).

## Change your SSO setup

To change your identity provider or its SSO connection, email <support@felt.com>.

## Troubleshooting SSO

### SSO setup says the email domain "is already taken"

Another Felt workspace already has SSO for your email domain, and each domain can belong to only one workspace. Email <support@felt.com> to move SSO to this workspace.

### Test Connection fails

Either no one is assigned to the SAML app in your identity provider yet, or one of the six values doesn't match. Assign your own account to the app, check each value against the setup guide, then click **Test Connection** again.

## Frequently asked questions

<details>

<summary>Can people on other email domains still use my workspace?</summary>

Yes. You can invite people on any email domain, even with **Require SSO login** on. That setting applies only to your SSO email domain, so people on other domains log in the usual way.

</details>

<details>

<summary>If I remove someone in my identity provider, are they removed from Felt?</summary>

No. Felt's SSO uses SAML, which controls login, not SCIM, which removes accounts. Removing someone there stops their SSO login, but they can still log in with a password if **Require SSO login** is off or they're a workspace admin. To remove them, see [Remove a member](/administration/manage-members.md#remove-a-member). Their maps and data then move to you.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.felt.com/administration/sso.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.