> ## Documentation Index
> Fetch the complete documentation index at: https://www.voiceflow.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO settings

> Open Settings → SSO as an Enterprise organization administrator. The SAML connection applies to the organization.

## Where these settings apply

Open **Settings → SSO** as an Enterprise organization administrator. The SAML connection applies to the organization. Follow [Set up SSO](/docs/documentation/account-management/sso/setup) for the complete assisted setup process.

## Configuration fields

### Values you enter in Voiceflow

| Field | Source and purpose |
| --- | --- |
| Entity ID URL | The entity identifier supplied for your identity-provider configuration. Use the value agreed with your identity-provider administrator and Voiceflow during onboarding. |
| IdP SSO Target URL | Your provider’s SAML sign-in endpoint, used to direct users from Voiceflow to the provider. Supply it for Voiceflow-initiated sign-in. |
| X.509 Certificate | The provider’s public signing certificate, used to validate SAML responses. Supply the PEM certificate, including its BEGIN CERTIFICATE and END CERTIFICATE markers; never a private key. |

### Values you copy to your identity provider

These appear after a provider profile has been created.

| Field | Value and purpose |
| --- | --- |
| Audience URI (SP Entity ID) | `https://voiceflow.com`; identifies Voiceflow as the service provider. |
| ACS/Callback URL | The connection-specific endpoint receiving your provider’s SAML response. Copy the displayed URL exactly for a new connection. Existing legacy connections should retain their working callback until Voiceflow confirms a change. |

The editable **Entity ID URL** and read-only **Audience URI (SP Entity ID)** are different controls. Do not swap values merely because both include “Entity ID.”

## Validation and account behavior

**Save behavior.** Voiceflow creates or updates the provider record, then checks the certificate and SAML configuration. An error can occur after values are stored. Validation does not complete a sign-in against your provider.

**Email identity.** Configure an email-address NameID (`urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`). The implementation also accepts a valid email in the `email` attribute or `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` claim. Use the same work email as the intended Voiceflow account.

**Membership.** Newly created SSO accounts receive an organization Viewer role. Existing accounts are matched by email and do not automatically gain new organization membership through that login branch. One account cannot be associated with two different SAML providers through this flow.

### Updating your certificate — you

If you still have organization administrator access, replace **X.509 Certificate** in **Settings → SSO** and select **Save**, coordinating timing with your identity-provider administrator. Verify a fresh sign-in in another browser session. Arrange the change before expiration; if you cannot access settings or save successfully, contact Voiceflow. Do not assume automatic or overlapping certificate rotation.

### Changing domains or recovering access — Voiceflow’s team

Contact your Customer Success representative to add or change sign-in domains, coordinate existing-account migration, or recover administrator access. Include all domains that must continue working. Changing an email domain in your identity provider does not register it in Voiceflow.

## Example: exchanging configuration values

Your identity-provider administrator supplies the provider’s entity identifier, sign-in endpoint, and public certificate. You enter those in Voiceflow. You then return Voiceflow’s audience value and connection-specific callback to that administrator to finish the SAML application. Verify the exchange with a test sign-in, not just by comparing field labels.

## Related guides

[Single sign-on](/docs/documentation/account-management/sso/overview) · [Set up SSO](/docs/documentation/account-management/sso/setup) · [Troubleshoot SSO](/docs/documentation/account-management/sso/troubleshooting)