Administrators turn on single sign-on (SSO) in Workspace Administration, in the Manage Single Sign-On window. SmartSuite supports the SAML and OpenID Connect protocols, and SSO is available on the Enterprise and Signature plans.

SSO applies to the whole workspace. You cannot turn it off for one solution and keep it on for others.

Example: a compliance team on Enterprise connects SmartSuite to Microsoft Entra ID before its SOC 2 audit. Control owners then sign in with their company accounts, and the auditor sees one identity provider for every system.

Plan Availability	Enterprise, Signature.
Permissions	Administrators.
Platform	Web
Related Reading	SSO Login Issues and Recovery Scenarios Configuring SCIM Microsoft authentication and SSO Choosing Your Data Region.

Not here for configuring SSO?

Members cannot sign in with SSO: See SSO Login Issues and Recovery Scenarios.
Provision members with SCIM: See Configuring SCIM.
Assign roles through SCIM: See Assigning SmartSuite Member Roles via SCIM.
Sign in with Microsoft: See Microsoft authentication and SSO.
Every enterprise security control: See Enterprise Security and DLP Controls in SmartSuite.

Before you begin

Collect these details from your identity provider (IdP) team:

Email domain: the domain your SSO covers, such as mycompany.com.
Protocol: SAML or OpenID Connect.
For OpenID Connect: the Client ID, Client Secret and OIDC Issuer.
For SAML: the metadata XML file or its URL, and the user attribute that holds the email.

If your IdP needs SmartSuite's metadata, it is at this address:

https://app.smartsuite.com/authentication/login/sso/metadata

Opening the SSO settings

Select your profile icon, then Workspace Administration.
Select Access under Security, then select Edit in the Single Sign-On row.
The Single Sign-On window opens. Enter your Email Domains, then choose the protocol.

The Single Sign-On window with the Enable Single Sign On toggle, Email Domains, Required SSO and Protocol, here set to OpenID Connect.

Configuring OpenID Connect

Turn the SSO toggle to Currently Enabled.
Enter your email domain, such as mycompany.com. For several domains, separate them with commas.
In Protocol, select OpenID Connect.
Enter the Client ID, Client Secret and OIDC Issuer from your IAM team.
Copy the Callback URL and add it in your OIDC Issuer.
Optional: enter a Logout Landing Page URL.
Select Save Configuration.

When it works, the Single Sign-On section of Workspace Settings shows an Enabled indicator.

Configuring SAML

Turn the SSO toggle to Currently Enabled.
Enter your email domain. For several domains, separate them with commas.
In Protocol, select SAML.
Enter the SAML Metadata URL, or upload the metadata file and leave the URL blank.
Enter the User Email Attribute, the SAML attribute that holds the member's email.
Optional: enter a User ID Attribute when the unique ID differs from the email.
Optional: enter a User Groups Attribute to place members in Teams at sign-in.
Optional: check Single Sign Out, then set your IdP to post the LogoutResponse to the Single Sign Out URL.
Copy the Assertion Consumer Service (ACS) URL and Entity ID into your IdP.
Select Save Configuration.

For Microsoft Entra ID, the User Email Attribute is:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Note: A User Groups Attribute can be a comma-separated string or an array of group names. At each sign-in, the member joins the listed Teams and leaves any Team not listed.

To change the setup later, select Edit in the Single Sign-On section.

The User ID Attribute: an example

Some universities identify people by ePPN, which looks like an email but may not be the primary one. Map them this way:

User Email Attribute: email, the member's primary email.
User ID Attribute: ePPN.

Logout options

Single Sign Out lets your IdP take part in the logout through SAML.
Logout Landing Page sends members to a URL after their SmartSuite session ends, such as your IdP's logout page.

The Logout Landing Page is optional. If you enter one, it must be a valid URL, or a message appears under the field and the setup does not save. Without one, SmartSuite uses its default logout. It applies only to SSO workspaces.

Microsoft Entra ID setup

In Microsoft Entra:

Go to Identity > Applications > Enterprise Applications.
Select + New application, then + Create your own application.
Name the app, such as SmartSuite SSO, and select Integrate any other application.
Select Single sign-on, then SAML.
In Basic SAML Configuration, set the Entity ID to urn:amazon:cognito:sp:us-east-2_OvB5P61CZ.
Set the Reply URL to https://auth-main.smartsuite.com/saml2/idpresponse and save.
In SAML Certificates, download the Federation Metadata XML file.

Then, in SmartSuite, open Manage Single Sign-On, turn it on, enter your domain, select SAML, upload the XML file and enter the Entra email attribute above.

Tips

All the domains you list must use one IdP.
Changes can take up to 5 minutes to take effect.
An Administrator must still invite each member. Invited members get an email with a verification code, then sign in with SSO.

Tip: Keep one Administrator able to sign in without SSO while you test. See SSO Login Issues and Recovery Scenarios.

Frequently asked questions

Does SmartSuite SSO work with Shibboleth?

Yes. Shibboleth supports SAML, one of the two protocols SmartSuite supports. It does not support OpenID Connect.

Can Administrators sign in with SSO?

Yes. Administrators can sign in with SSO like any other member.

What is the key identifier SmartSuite uses for SSO?

SmartSuite uses email as the key identifier.

How do we provision and remove members?

On Enterprise and Signature, provision with SCIM. Without SCIM, an Administrator invites members and deactivates or deletes them, by hand or through the REST API. See Configuring SCIM.

How is data protected?

All internal data is transiting only through internal AWS VPC without any connection to the Internet. All external data has SSL encryption with latest AWS SSL security policies. All data at rest encrypted with AWS KMS keys generated for our account. Endpoints of our application are secured with AWS WAF protection.

Will SmartSuite staff access SSO data such as names and emails?

SmartSuite processes this data only to provide, secure, maintain and support the service, as the Data Processing Addendum sets out, and the people authorized to process it are bound by confidentiality obligations.

Need more help? Ask the SmartSuite Community, where builders, administrators and the SmartSuite team answer questions about building on SmartSuite. For your account, billing or data, select the chat button in the lower-right corner of SmartSuite to reach support.

Last verified 1 Nov 2026.

Configuring Single Sign-On (SSO)