Single sign-on
Let your team sign in with your identity provider, and what to know about roles and offboarding.
Taizen supports SAML/OIDC single sign-on through WorkOS, so your team signs in with the identity provider you already run — Okta, Entra ID, Google Workspace, OneLogin, or any other IdP WorkOS connects to.
What your users see
On the login screen, Continue with SSO appears for email domains that have SSO enabled. Click it and you're sent to your IdP, authenticate there, and come back signed in.
The button is domain-gated: Taizen looks up which methods your email domain allows before showing anything, so people at organizations without SSO never see an option that wouldn't work for them.
Each domain is configured one of three ways:
| Configuration | Login screen shows |
|---|---|
| SSO only | Continue with SSO. Passwords are not accepted |
| SSO and password | Both options |
| Password only | Email and password |
SSO only is the configuration to ask for if you want your IdP to be the single gate: while passwords remain enabled, disabling someone in your IdP doesn't stop them signing in.
Setting it up
SSO is configured by Taizen rather than self-serve — there's no SSO screen in Settings. Setup is quick, but it needs a short exchange:
- Tell us which IdP you use and which email domains should be covered. Multiple domains are fine — useful if you've acquired a company or run more than one brand.
- Connect your IdP. You'll set up a SAML or OIDC application on your side and exchange metadata: the ACS URL and entity ID we provide, and your IdP's certificate and sign-on URL.
- Choose whether passwords stay enabled for your domains, or whether SSO becomes the only way in.
- Test with one account, then we switch the domain over.
Ask your Taizen contact to start this. Have your IdP admin available for step 2 — that's usually the only part that needs scheduling.
First login
Accounts are created on first sign-in from your IdP profile, so you don't pre-invite anyone. New SSO users arrive as Viewer; an Admin promotes them under Settings → Organization (roles).
Troubleshooting
| Symptom | Cause |
|---|---|
| No Continue with SSO button | Your email domain isn't enabled for SSO yet, or you typed a personal address |
| Redirected back with an error | The IdP rejected the request, or the app config doesn't match the metadata we exchanged. The message on the error page names the reason |
| Signed in but can't change anything | You were provisioned as a Viewer — ask an Admin to promote you |
| Signed in as the wrong organization | The domain is mapped to another tenant. Tell us; it's a config fix, not something you can change in the app |
| A departed colleague can still sign in | Your domain allows passwords as well as SSO, so disabling them in your IdP isn't enough — remove them in Settings → Organization |