> ## Documentation Index
> Fetch the complete documentation index at: https://usepike.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> How to set up SAML 2.0 or OpenID Connect single sign-on for Pike with Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, or any SAML or OIDC provider.

Single sign-on (SSO) lets members sign in to Pike through your identity provider with SAML 2.0 or OpenID Connect. It works with Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, and any SAML 2.0 or OIDC provider. SSO is available on the Enterprise plan.

## Connect single sign-on

1. Go to **Workspace settings** → **Integrations** → **Single sign-on**.
2. Click **Add integration** and choose **SAML 2.0** or **OpenID Connect**.
3. Verify your email domains (see [Domains](#domains)).
4. Set up Pike in your identity provider using the tab for your provider below.

Only workspace admins can connect or disconnect single sign-on.

## Domains

Verify one or more email domains by adding the DNS TXT record Pike shows to each domain. Members with an email on a verified domain can sign in through the identity provider.

## Set up your identity provider

**Okta**

1. In the Okta Admin Console, go to **Applications** → **Applications** and
   click **Create App Integration**. 2. Choose **SAML 2.0** or **OIDC**,
   matching the protocol you picked in Pike. 3. Enter the service provider
   details Pike shows on the integration page. 4. Assign the people and groups
   who use Pike. 5. Copy the identity provider details from Okta into Pike and
   save.

**Entra ID**

1. In the Microsoft Entra admin center, go to **Enterprise applications**
   and click **New application**, then **Create your own application**. 2. Open
   **Single sign-on** and choose **SAML**, or register an app for OpenID
   Connect. 3. Enter the service provider details Pike shows on the integration
   page. 4. Assign the users and groups who use Pike. 5. Copy the identity
   provider details from Entra ID into Pike and save.

**Google Workspace**

1. In the Google Admin console, go to **Apps** → **Web and mobile apps** and
   choose **Add custom SAML app**. 2. Copy the identity provider details from
   Google into Pike. 3. Enter the service provider details Pike shows on the
   integration page. 4. Turn the app on for the organizational units or groups
   who use Pike, then save in Pike.

**OneLogin**

1. In OneLogin, go to **Applications** → **Add App** and choose a SAML
   custom connector or an OpenID Connect app. 2. Enter the service provider
   details Pike shows on the integration page. 3. Assign the users and roles
   who use Pike. 4. Copy the identity provider details from OneLogin into Pike
   and save.

**JumpCloud**

1. In the JumpCloud Admin Portal, go to **SSO Applications** and add a
   custom SAML or OIDC application. 2. Enter the service provider details Pike
   shows on the integration page. 3. Bind the user groups who use Pike. 4. Copy
   the identity provider details from JumpCloud into Pike and save.

**Generic SAML**

1. In your identity provider, create a SAML 2.0 application. 2. Enter the
   service provider details Pike shows on the integration page. 3. Send the
   user's email address as the name identifier, and include groups if you use
   group mapping. 4. Copy the identity provider metadata into Pike and save.

**Generic OIDC**

1. In your identity provider, register an OpenID Connect application. 2.
   Enter the redirect details Pike shows on the integration page. 3. Include
   the email claim, and a groups claim if you use group mapping. 4. Copy the
   issuer, client ID, and client secret into Pike and save.

## How sign-in works

Sign-in works both SP-initiated (starting from the Pike sign-in page) and IdP-initiated (starting from your identity provider's app list).

| Setting | What it does |
| - | - |
| **Enforce SSO** | When on, members with a verified domain must sign in through the identity provider. Workspace admins keep a recovery sign-in. |
| **Just-in-time provisioning** | Creates a member on first sign-in, with the default role the admin sets. |
| **Group mapping** | Maps identity provider groups to Pike roles and teams. |

To create, update, and deactivate members before they sign in, add [SCIM provisioning](https://usepike.com/docs/integrations/scim.md).

## Disconnect

Disconnecting single sign-on returns members to their other sign-in methods. Members and their history stay in Pike.

## Permissions

Members who sign in through SSO get the Pike roles and teams set by group mapping or by an admin. Synced data respects Pike roles and private projects. A private project's tasks never sync out to anyone who cannot see the project in Pike.

## Limits

* Single sign-on is available on the Enterprise plan.
* Members sign in through SSO only with an email on a verified domain.
* Workspace admins keep a recovery sign-in when SSO is enforced.

## Related

* [Single sign-on and SCIM overview](https://usepike.com/integrations/sso): Identity providers, provisioning, and FAQs.
* [SCIM provisioning](https://usepike.com/docs/integrations/scim.md): Create, update, and deactivate members from your identity provider.
* [Workspace roles](https://usepike.com/docs/members/workspace-roles.md): What each Pike role can do.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.