> ## Documentation Index > Fetch the complete documentation index at: https://thehyperstack.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-On (SSO) > Let your team sign in to the Studio with Okta, Microsoft Entra ID or another identity provider. With single sign-on, your team signs in to Hyperstack with the same work account they use for their other apps. Your IT team gives and takes away access in one place: your identity provider, such as Okta or Microsoft Entra ID. ![Settings, Single sign-on, with the Okta SAML connection, the sign-in link and two verified domains](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-settings-on.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=6a3f537ebda2a64b9501da1bf48d57f8) > [!NOTE] > > Single sign-on is on the Enterprise plan. Only administrators can open **Settings → Single sign-on**. Single sign-on is for your Studio team: the people who design, issue and manage credentials. Recipients still open their wallet and credentials as before. ## Words used in these guides | Word | What it means | | - | - | | **Identity provider (IdP)** | The service where your company's work accounts live, such as Okta, Microsoft Entra ID or Google Workspace. | | **SAML** and **OIDC** | Two standard ways for Hyperstack and your identity provider to talk. Hyperstack supports both. For Okta and Entra we recommend SAML. | | **Verified domain** | An email domain, such as `acme.com`, that you prove is yours with a DNS record. Only emails on a verified domain can sign in with SSO. | | **Enforce SSO** | Make SSO the only way into your organization. | ## What you need * The Enterprise plan. * An administrator of your Hyperstack organization. * The person who manages Okta, Entra or your other identity provider. Set-up takes about 20 minutes, so ask them to join you. * Access to the DNS of your email domain, to add one TXT record. ## How set-up works Go to **Settings → Single sign-on**. The page takes you through six steps: 1. **Choose your identity provider**: Okta, Microsoft Entra, **Other SAML provider** or **Other OIDC provider**. 2. **Add Hyperstack to your provider**: copy our values into your provider. 3. **Connect your provider**: paste your provider's values back into Hyperstack, then click **Save connection**. 4. **Verify your email domains**: add a TXT record to your DNS. 5. **Test sign-in**: sign in once through your provider to prove that it works. 6. **Turn on SSO**: your team can now sign in with SSO. Passwords keep working. ![The Single sign-on set-up with the four provider choices and the six steps](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-settings-setup.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=646fae8d950054b4612d8c92d864d827) Nothing changes for your team until you click **Turn on SSO**. Later, you can [enforce SSO](https://thehyperstack.com/docs/tutorials/single-sign-on/domains-and-enforcement.md#enforce-sso) to make it the only way in. Follow the guide for your provider: > [card] [Okta](https://thehyperstack.com/docs/tutorials/single-sign-on/okta.md) > > SAML (recommended) or OIDC. > [card] [Microsoft Entra ID](https://thehyperstack.com/docs/tutorials/single-sign-on/microsoft-entra.md) > > SAML (recommended) or OIDC. > [card] [Other providers](https://thehyperstack.com/docs/tutorials/single-sign-on/other-identity-providers.md) > > Google Workspace, OneLogin, JumpCloud and any SAML or OIDC provider. ## Who can sign in with SSO Single sign-on lets in only people who are already on your team, or who have an invitation that is not accepted yet. * **Team members** sign in with SSO the first time and are linked to your provider. Their roles, their wallet and their other organizations don't change. * **Invited people** sign in with SSO and join your organization at once, with the roles of their invitation. They don't need a password. * **Owners and administrators** link their existing account to your provider only while they are signed in to Hyperstack. Sign in with your password first. Then run **Test sign-in** in **Settings → Single sign-on**, or sign in with SSO in the same browser. If not, the sign-in page shows **Sign in with your password first**. The same rule applies when an invitation makes an existing account an administrator. This stops someone in your provider from taking over an administrator's account. * **Everyone else** sees **You don't have access yet**. SSO never adds people to your team by itself. To add someone, [invite them](https://thehyperstack.com/docs/tutorials/advanced-setup/team-management.md#invite-a-member) in **Settings → Team** first. The person's email must also be on one of your verified domains. Hyperstack refuses an email on any other domain, even when your provider sends it and the person is on your team. Roles stay in Hyperstack. Your provider decides who can sign in. **Settings → Team** decides what each person can do. ## How your team signs in There are three ways in. They all go to your provider's sign-in page and come back to the Studio. ### From the Hyperstack sign-in page When SSO is on, the sign-in page checks your email domain. Type your work email: the password field folds away, the page says **Your organization signs in with SSO.**, and the button reads **Continue with SSO**. Click it to go to your provider. To use your password instead, click **Use password instead**. ![The sign-in page with a work email, the line Your organization signs in with SSO, the Continue with SSO button and Use password instead](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-sign-in-domain.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=caa86ab3db1d58104c182009fb6d201a) You can also start from the **Sign in with SSO** link: **1. On the sign-in page, click Sign in with SSO** The link is under the other ways to sign in. ![The Studio sign-in page with the Sign in with SSO link under Sign in with Google](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-sign-in.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=b8906ba892e64b1383c799e0d5057c78) **2. Enter your work email and click Continue** Hyperstack sends you to your company's sign-in page. ![The Sign in with SSO step with a work email and the Continue button](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-sign-in-step.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=65e128b55f4951e306b8be986d330b73) **3. Sign in with your work account** You come back to your organization in the Studio. If your email domain has no SSO, you see **Your organization hasn't set up SSO. Sign in with your password.** Personal emails such as gmail.com can't use SSO. When your organization [enforces SSO](https://thehyperstack.com/docs/tutorials/single-sign-on/domains-and-enforcement.md#enforce-sso), the password, Google and passkey buttons are behind **Sign in another way**. Single sign-on works on the Studio only. Your wallet keeps every way to sign in. ### From the Okta or Microsoft My Apps tile When you use SAML, Hyperstack shows as a tile in the Okta dashboard or in Microsoft My Apps. Click the tile to open your organization in the Studio. With Okta OIDC, the tile works when you set **Login initiated by** to **Either Okta or App**. ### From the sign-in link **Settings → Single sign-on → Sign-in link** has a link for your organization. Put it in your bookmarks or on your intranet. It goes straight to your provider, with no email step. ## Owner emergency access When you enforce SSO and your provider stops working, the owner of the organization can still get in. This is the only way past an enforced SSO, and only the owner has it. **1. Sign in with two-factor authentication or a passkey** Sign in with your password and your two-factor code, or with a passkey. Google sign-in doesn't count. **2. Click Use owner emergency access** The owner sees the **Acme requires single sign-on** page like every member, with **Use owner emergency access** next to the SSO button. ![Globex Learning requires single sign-on, with Continue with Okta and Use owner emergency access](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-required.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=532d4e6a045da6c9db5661c534586171) **3. Click Open Acme** The dialog **Open Acme with emergency access?** says: **Use this only if SSO doesn't work. We log it and email every admin.** Emergency access lasts 24 hours in that browser. While it is on, the sidebar shows **You're in with emergency access**. Each use writes a row in the audit logs, and every administrator gets an email. If you signed in with only a password, or with Google, the dialog says **Emergency access needs a sign-in with two-factor or a passkey. Sign out, then sign in with one.** This is why Hyperstack asks the owner to turn on two-factor authentication or add a passkey before SSO can be enforced. See [Account security](https://thehyperstack.com/docs/tutorials/advanced-setup/account-security.md). ## What Hyperstack support can and can't do **Support can:** * See your organization's SSO status, provider, domains, certificate date, how many members are linked, and the reason of the last failed sign-in, to help you fix it. * Stop enforcing SSO when your organization is locked out. Before we do this, we check who is asking: a request from the owner's email and a second proof, such as a reply from your billing contact or a call. After the change, every administrator gets an email with the reason, and the audit logs show **Hyperstack support** with the reason. **Support can't:** * See your client secret. Hyperstack never shows a saved secret, also not to support. * Change settings in your Okta, Entra or other provider. * Tell you which organization uses a domain that you want to add. * Turn SSO on, change your connection or verify a domain for you. Hyperstack staff tools work the same with SSO on, and each use is logged. ## Questions > [accordion] Is single sign-on on my plan? > > Single sign-on is on the Enterprise plan. On other plans, **Settings → Single sign-on** shows **Single sign-on isn't in your plan** and an **Upgrade plan** button. > > ![Single sign-on isn't in your plan, with the Upgrade plan button](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-upgrade.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=744ee1c2cb7bd6a2c5eedb450cf5c20a) > [accordion] What happens to SSO if we leave the Enterprise plan? > > SSO keeps working, and enforcement stays on, so your organization never opens to passwords by itself. **Settings → Single sign-on** shows **Your plan no longer includes single sign-on**. You can still click **Stop enforcing** or **Turn off SSO**. To change, test or enforce SSO again, upgrade your plan. > > ![Your plan no longer includes single sign-on, with Stop enforcing and Turn off SSO](https://mintcdn.com/hyperstack/TA62Nx2wusH3dKmj/images/sso-lapsed.webp?fit=max\&auto=format\&n=TA62Nx2wusH3dKmj\&q=85\&s=f64b7373b8101dc325f1036dee02237b) > [accordion] Do new people join by themselves when they sign in with SSO? > > No. Hyperstack doesn't add people to your team when they first sign in. Invite them in **Settings → Team**. When they sign in with SSO, they accept the invitation and get its roles. > [accordion] What happens when we turn someone off in Okta or Entra? > > They can't start a new SSO sign-in. When you enforce SSO, each member must sign in with SSO again every 24 hours, so they lose access to your organization within a day. To remove someone at once, remove them in **Settings → Team**. > [accordion] Can people still use their password? > > Yes, until you enforce SSO. When SSO is enforced, a password, Google or a passkey still opens the person's wallet and their other organizations, but not yours. See [Domains and enforcement](https://thehyperstack.com/docs/tutorials/single-sign-on/domains-and-enforcement.md#enforce-sso). > [accordion] A member is in two organizations. Does SSO change the other one? > > No. SSO rules apply to one organization only. A member of Acme (with SSO) and of another organization (without SSO) still signs in to the other one as before. > [accordion] Can we use more than one identity provider? > > No. Each organization has one SSO connection, with SAML or OIDC. > [accordion] Can a department have its own SSO? > > No. A department can't have its own SSO connection or domains. **Settings → Single sign-on** in a department says **Single sign-on is set up on the main organization**. > > The main organization's SSO and enforcement don't cover its departments yet. Members open a department in the same way as before. > [accordion] Does SSO sign people out of Hyperstack when they sign out of Okta or Entra? > > No. Signing out of your provider doesn't sign you out of Hyperstack, and signing out of Hyperstack doesn't sign you out of your provider. > [accordion] Can SSO create our team from our directory (SCIM)? > > Not yet. Add and remove team members in **Settings → Team**. > [accordion] Do our API keys, webhooks and integrations keep working? > > Yes. API keys and webhooks belong to your organization, not to a person, so SSO doesn't change them. > [accordion] Can recipients sign in to their wallet with our SSO? > > No. SSO is for your Studio team only. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.