Skip to content
Team Connect
Sign in

SSO and SCIM

Set up single sign-on with OIDC or SAML and let your identity provider create and deactivate people in Team Connect.

With single sign-on (SSO), people sign in to Team Connect with their company account, with no extra password. With SCIM provisioning, your identity provider (Microsoft Entra ID, Okta, Google Workspace, JumpCloud, OneLogin, Keycloak, Authentik and others) adds and deactivates people automatically.

Where to set it up

  1. In the sidebar, open Integrations and choose the Company tab.
  2. On the SSO and provisioning (SAML, OIDC, SCIM) card, click Configure.

Only people with the permission to manage the team see this card (the same permission used for invitations). See Roles and permissions.

Connect single sign-on

  1. In Identity provider, choose your provider (or Other provider). The choice only fills in hints on the screen.
  2. In Protocol, choose OpenID Connect (OIDC) or SAML 2.0.
  3. Fill in the details of the application you created in the provider:
    • OIDC: Issuer URL, Client ID and Client secret.
    • SAML: paste the Provider metadata (XML) or fill in Sign-in URL (SSO URL) and Certificate. The provider's responses must be signed.
  4. In Company email domains, enter the domains separated by commas (for example, company.com). Only people with an email in these domains use this sign-in.
  5. Adjust the Sign-in button text if you like, and click Save connection.
  6. Copy the values under Team Connect metadata (such as Redirect URI, ACS URL (Reply URL) and Entity ID (Identifier)) and register them in the provider's application.

The client secret is stored and never shown again. To change it, fill in the field again; leave it blank to keep the current one.

Verify the domains

Single sign-on only works after at least one domain is verified.

  1. In the Domains section, copy the name and value of each domain's TXT record (Copy value).
  2. Create that record in the domain's DNS.
  3. Come back and click Verify. The domain changes from Pending to Verified.

Verification also protects accounts: an existing password account is only linked to the company sign-in when the email's domain is verified.

Decide who gets in

In the Who gets in section:

  • Automatic entry (off by default): anyone with an email in a verified domain joins as a member on first sign-in, if the license has a free seat. When it is off, only members and people with a pending invitation get in. A pending invitation is accepted automatically on the first SSO sign-in, with the invitation's role.
  • Require SSO (off by default): emails of verified domains can no longer sign in with a password. To turn it on, sign in once with SSO using your own account: use Test SSO sign-in. The company owner and the server administrator can still use a password, so they are never locked out.

Blocked emails never get in, with or without SSO.

What people see

The sign-in screen shows a Sign in with SSO button. The person enters their email, goes to the provider and comes back already inside the office. If the company requires SSO and they try a password, the screen shows only the SSO button. The name comes from the provider on the first sign-in; after that, each person can change their own name.

Turn on SCIM provisioning

  1. In the Provisioning (SCIM) section, click Generate token.
  2. Copy the SCIM base URL (Tenant URL) and the token and paste them into your provider's provisioning application.

What happens to people:

  • Created or reactivated in the provider: joins the company as a member, if there is a free seat and the email is not blocked. If an account with the same email already exists, it is reused.
  • Deactivated or removed in the provider: leaves the company (teams and permissions) and their sessions end. Their history (messages, records) is kept, and the person can be reactivated later.
  • The company owner cannot be deactivated through SCIM.
  • Provider groups do not become teams or roles yet.

Remove the connection

Click Remove and confirm. People go back to signing in with email and password, and Require SSO is turned off. Sessions already open continue until they expire.

Privacy (LGPD)

From the provider, Team Connect keeps only each person's email, name and identifier. Secrets and tokens never appear on screens or in the audit log. Configuration changes, refused sign-ins and provisioning are recorded in the audit log.