Where these settings apply
Open Settings → SSO as an Enterprise organization administrator. The SAML connection applies to the organization. Follow Set up SSO for the complete assisted setup process.
Configuration fields
Values you enter in Voiceflow
Values you copy to your identity provider
These appear after a provider profile has been created.
The editable Entity ID URL and read-only Audience URI (SP Entity ID) are different controls. Do not swap values merely because both include “Entity ID.”
Validation and account behavior
Save behavior. Voiceflow creates or updates the provider record, then checks the certificate and SAML configuration. An error can occur after values are stored. Validation does not complete a sign-in against your provider.
Email identity. Configure an email-address NameID (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress). The implementation also accepts a valid email in the email attribute or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress claim. Use the same work email as the intended Voiceflow account.
Membership. Newly created SSO accounts receive an organization Viewer role. Existing accounts are matched by email and do not automatically gain new organization membership through that login branch. One account cannot be associated with two different SAML providers through this flow.
Updating your certificate — you
If you still have organization administrator access, replace X.509 Certificate in Settings → SSO and select Save, coordinating timing with your identity-provider administrator. Verify a fresh sign-in in another browser session. Arrange the change before expiration; if you cannot access settings or save successfully, contact Voiceflow. Do not assume automatic or overlapping certificate rotation.
Changing domains or recovering access — Voiceflow’s team
Contact your Customer Success representative to add or change sign-in domains, coordinate existing-account migration, or recover administrator access. Include all domains that must continue working. Changing an email domain in your identity provider does not register it in Voiceflow.
Example: exchanging configuration values
Your identity-provider administrator supplies the provider’s entity identifier, sign-in endpoint, and public certificate. You enter those in Voiceflow. You then return Voiceflow’s audience value and connection-specific callback to that administrator to finish the SAML application. Verify the exchange with a test sign-in, not just by comparing field labels.