> ## Documentation Index
> Fetch the complete documentation index at: https://www.voiceflow.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Single sign-on (SSO) lets your teammates authenticate to Voiceflow through your organization’s SAML 2.0 identity provider.

## SSO for your Voiceflow team

Single sign-on (SSO) lets your teammates authenticate to Voiceflow through your organization’s SAML 2.0 identity provider. It controls team sign-in to Voiceflow, not the authentication of customers talking to your agents.

<Info>**Assisted setup.** Contact your Voiceflow Customer Success representative before configuring SSO. Voiceflow helps prepare your organization, register your email domains, and coordinate existing-account migration. You then configure the connection with your identity-provider administrator.</Info>

## When to use SSO

Use SSO when your organization manages employee sign-in through a central identity provider. SSO settings are available to Enterprise organization administrators. Being an administrator of an individual workspace does not by itself establish organization-level access.

| Voiceflow’s team handles | You configure |
| --- | --- |
| Organization setup and required administrator access | The SAML application in your identity provider |
| Registering or changing SSO email domains | Identity provider details and certificate in Settings → SSO |
| Assistance migrating existing accounts | Voiceflow’s audience and callback values in your identity provider |
| Recovery when administrators cannot access settings | User assignment in your identity provider and sign-in testing |

## How sign-in works

When you enter your work email on the Voiceflow login page, Voiceflow looks for an SSO connection associated with that email domain. Your identity provider authenticates you and sends Voiceflow a SAML response identifying your email address. Voiceflow validates the response and creates a sign-in session.

You can also start sign-in from your identity provider’s application launcher when configured. Workspace membership and permissions determine what you can access after signing in; authentication and access are separate.

The connection belongs to your organization even though you open its settings from a workspace.

## Example: onboarding a teammate

Your company registers its work email domain with Voiceflow and configures a SAML application. Your identity-provider administrator assigns a teammate to that application. The teammate enters their work email in Voiceflow and completes authentication with the provider. An administrator then verifies that the teammate can access the intended workspaces with the appropriate role.

A newly created SSO account receives an organization Viewer role. An existing account is reused by email; successful sign-in does not automatically grant it new organization or workspace access. Coordinate existing-account migration with Voiceflow.

## Plan your rollout

Complete a sign-in test before rolling out instructions to the whole team. Saving configuration is not an end-to-end authentication test. Keep an administrator signed in while testing in a separate browser session.

Contact Voiceflow for domain changes, account migration, or access recovery. Do not assume removing someone from your identity provider immediately removes their Voiceflow memberships or ends existing sessions; coordinate offboarding with your organization administrator and Voiceflow.

## Next steps

[Set up SSO](/docs/documentation/account-management/sso/setup) · [SSO settings](/docs/documentation/account-management/sso/settings) · [Troubleshoot SSO](/docs/documentation/account-management/sso/troubleshooting)