> ## Documentation Index
> Fetch the complete documentation index at: https://www.voiceflow.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SSO

> Set up your organization’s identity provider so your team can sign in to Voiceflow and a test user can access the intended workspace.

## What you will accomplish

Your team can sign in to Voiceflow through your organization’s identity provider, and a test user can access the intended workspace. **This is an assisted setup:** Voiceflow prepares organization access and domain routing; you configure the SAML application and connection.

## Before you begin

You need an Enterprise organization, organization administrator access in Voiceflow, and an administrator who can configure your identity provider’s SAML application. Identify the work email domains and existing Voiceflow accounts involved.

Contact your Voiceflow Customer Success representative to coordinate setup and a test user. For an existing connection, retain its working configuration and callback URL until a replacement is verified. Keep an administrator signed in while testing with a separate browser session.

## Configure and test SSO

<Steps>
<Step title="Voiceflow’s team: prepare your organization">
Ask your Customer Success representative to confirm organization setup, the administrator who will configure SSO, and the email domains that should use the connection. Include any existing accounts that need migration. Coordinate when domain routing will be enabled so users are not directed to an unfinished connection.
</Step>
<Step title="You: prepare the identity-provider application">
With your identity-provider administrator, prepare a SAML 2.0 application for Voiceflow. Obtain its **Entity ID URL**, **IdP SSO Target URL**, and **X.509 Certificate**. Configure it to identify users by their work email address. The application will also need the Voiceflow audience and callback values obtained below. If your provider requires those values before it can issue its own settings, coordinate the initial configuration with Voiceflow rather than inventing a callback URL.
</Step>
<Step title="You: save the connection in Voiceflow">
Open **Settings → SSO**. Enter the provider details and certificate, then select **Save**. Creating the provider profile makes **Audience URI (SP Entity ID)** and **ACS/Callback URL** available. See the [settings reference](/docs/documentation/account-management/sso/settings) for the direction of each value.

If saving reports **Invalid SAML configuration**, stop and resolve it with the troubleshooting guide or Voiceflow. Configuration is saved before validation runs, so an error does not mean the previous values were preserved. Do not repeatedly save placeholder values to bypass validation.
</Step>
<Step title="You: complete the identity-provider configuration">
Copy **Audience URI (SP Entity ID)** and **ACS/Callback URL** from Voiceflow into the corresponding audience/entity and assertion-consumer fields in your SAML application. Copy the callback exactly; it is specific to your connection. For an established connection using a different callback format, ask Voiceflow before changing it. Assign the agreed test user to the application.
</Step>
<Step title="Voiceflow’s team: confirm routing and account readiness">
Confirm that the agreed email domains are registered for the organization and that any existing-account migration is ready. Domain routing is managed by Voiceflow; there is no customer domain-entry field on the SSO settings page.
</Step>
<Step title="You: test sign-in and workspace access">
In a separate browser session, open your Voiceflow login page and enter the test user’s work email. Complete the identity-provider sign-in and confirm that you return to Voiceflow. Open the intended workspace and verify the expected role. If your team will use the provider’s application launcher, test that entry point too. Coordinate an additional existing-account test with Voiceflow before migrating the wider team.
</Step>
</Steps>

## Confirm the rollout is ready

Verify that the correct domain routes to the expected provider, the test user returns to the correct Voiceflow account, and the intended workspaces and permissions are available. Test each registered email domain. A successful **Save** or a successful identity-provider login alone is not sufficient. Share rollout instructions only after these checks pass.

## If setup fails

Keep the original administrator session open. Use [Troubleshoot SSO](/docs/documentation/account-management/sso/troubleshooting) to identify whether the failure is configuration, routing, authentication, or access. Contact your Customer Success representative if domain routing, existing-account migration, or administrator recovery is involved. Do not delete the user or create a replacement account as a workaround.