What you will accomplish
Your team can sign in to Voiceflow through your organization’s identity provider, and a test user can access the intended workspace. This is an assisted setup: Voiceflow prepares organization access and domain routing; you configure the SAML application and connection.
Before you begin
You need an Enterprise organization, organization administrator access in Voiceflow, and an administrator who can configure your identity provider’s SAML application. Identify the work email domains and existing Voiceflow accounts involved.
Contact your Voiceflow Customer Success representative to coordinate setup and a test user. For an existing connection, retain its working configuration and callback URL until a replacement is verified. Keep an administrator signed in while testing with a separate browser session.
Configure and test SSO
Voiceflow’s team: prepare your organization
Ask your Customer Success representative to confirm organization setup, the administrator who will configure SSO, and the email domains that should use the connection. Include any existing accounts that need migration. Coordinate when domain routing will be enabled so users are not directed to an unfinished connection.
You: prepare the identity-provider application
With your identity-provider administrator, prepare a SAML 2.0 application for Voiceflow. Obtain its Entity ID URL, IdP SSO Target URL, and X.509 Certificate. Configure it to identify users by their work email address. The application will also need the Voiceflow audience and callback values obtained below. If your provider requires those values before it can issue its own settings, coordinate the initial configuration with Voiceflow rather than inventing a callback URL.
You: save the connection in Voiceflow
Open Settings → SSO. Enter the provider details and certificate, then select Save. Creating the provider profile makes Audience URI (SP Entity ID) and ACS/Callback URL available. See the settings reference for the direction of each value.
If saving reports Invalid SAML configuration, stop and resolve it with the troubleshooting guide or Voiceflow. Configuration is saved before validation runs, so an error does not mean the previous values were preserved. Do not repeatedly save placeholder values to bypass validation.
You: complete the identity-provider configuration
Copy Audience URI (SP Entity ID) and ACS/Callback URL from Voiceflow into the corresponding audience/entity and assertion-consumer fields in your SAML application. Copy the callback exactly; it is specific to your connection. For an established connection using a different callback format, ask Voiceflow before changing it. Assign the agreed test user to the application.
Voiceflow’s team: confirm routing and account readiness
Confirm that the agreed email domains are registered for the organization and that any existing-account migration is ready. Domain routing is managed by Voiceflow; there is no customer domain-entry field on the SSO settings page.
You: test sign-in and workspace access
In a separate browser session, open your Voiceflow login page and enter the test user’s work email. Complete the identity-provider sign-in and confirm that you return to Voiceflow. Open the intended workspace and verify the expected role. If your team will use the provider’s application launcher, test that entry point too. Coordinate an additional existing-account test with Voiceflow before migrating the wider team.
Confirm the rollout is ready
Verify that the correct domain routes to the expected provider, the test user returns to the correct Voiceflow account, and the intended workspaces and permissions are available. Test each registered email domain. A successful Save or a successful identity-provider login alone is not sufficient. Share rollout instructions only after these checks pass.
If setup fails
Keep the original administrator session open. Use Troubleshoot SSO to identify whether the failure is configuration, routing, authentication, or access. Contact your Customer Success representative if domain routing, existing-account migration, or administrator recovery is involved. Do not delete the user or create a replacement account as a workaround.