> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Use the existing SSO entry for configured organizations and prepare provider, provisioning, and recovery requirements.

Single sign-on lets an organization authenticate people through its identity provider. Authentication, workspace membership, and resource permissions remain separate decisions.

<Note>
  An SSO sign-in entry exists for organizations with a configured identity connection. Self-service provider-connection setup, domain administration, and a verified SCIM rollout are not released workflows. Sign-in availability depends on the deployment's organization and provider configuration.
</Note>

## Sign in to a configured organization

Use this flow only when your administrator has confirmed that the organization is configured.

<Steps>
  <Step title="Open SSO sign-in" id="sso-open-sign-in">
    Open [Continue with SSO](https://threetone.in/app/sso), enter your company address in **Email**, and select **Continue**.
  </Step>

  <Step title="Follow the configured provider flow" id="sso-provider-flow">
    The application looks up an organization using the email domain and starts authorization. If no matching workspace is found, ask the administrator to verify the domain and organization mapping.
  </Step>

  <Step title="Confirm workspace access" id="sso-confirm-workspace">
    After a successful sign-in, confirm the selected workspace and available resources. A successful identity-provider login alone does not establish every workspace permission.
  </Step>
</Steps>

## Prepare provider and SCIM setup

Use the focused preparation guides for [Microsoft Entra SAML SSO](/overview/administration/workspaces/sso/microsoft-entra-saml), [Okta SAML SSO](/overview/administration/workspaces/sso/okta-saml), and [SCIM](/overview/administration/workspaces/sso/scim).

| Area | Review before rollout |
| - | - |
| Provider connection | Organization, supported protocol, issuer or metadata, exact redirect endpoints, and certificate lifecycle |
| User mapping | Stable identity, email changes, workspace membership, and external collaborators |
| SCIM provisioning | Authoritative directory, user activation and removal, group mapping, and reconciliation behavior |
| Recovery | Administrator recovery access and a tested response to provider failure |

Existing directory-related fields or badges do not prove that provisioning and deprovisioning work end to end. Obtain supported setup instructions through the [Help Center](https://help.threetone.in/en) and verify the complete lifecycle before enforcing a new sign-in policy.

<AccordionGroup>
  <Accordion title="Is SSO the same as SCIM?" id="sso-faq-scim">No. SSO handles authentication; SCIM concerns directory provisioning. Each needs a separately supported and verified setup.</Accordion>
  <Accordion title="Can I enforce SSO from this page?" id="sso-faq-enforcement">No self-service enforcement control is documented. Do not infer enforcement from the presence of a sign-in form.</Accordion>
  <Accordion title="Which provider metadata should I paste into Threetone?" id="sso-faq-metadata">Wait for the supported connection instructions for your organization. Do not guess entity IDs, redirect URLs, certificates, or provisioning tokens.</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.