> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dacard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO)

> Configure SAML or OIDC SSO for your organization via Clerk.

<Note>
  SSO is on the Enterprise plan. SAML and OIDC supported (Okta, Azure AD/Entra, Google Workspace, OneLogin, any compliant IdP). Setup is handled by us during onboarding (1-2 business days). Pair with SCIM for full provisioning automation.
</Note>

# Single sign-on (SSO)

SSO lets your org authenticate through your existing identity provider (IdP) instead of username/password or Google SSO. All members sign in through your IdP, and access is revoked automatically when a user is offboarded there.

SSO is available on the **Enterprise plan**. Navigate to **Settings > SSO** to configure.

## Supported identity providers

<CardGroup cols={2}>
  <Card title="Okta" icon="shield-check">
    SAML 2.0 and OIDC. Most common enterprise IdP. Full provisioning support.
  </Card>

  <Card title="Azure AD / Entra" icon="microsoft">
    SAML 2.0 and OIDC. Native Microsoft identity for M365 organizations.
  </Card>

  <Card title="Google Workspace" icon="google">
    OIDC. For organizations using Google as their identity provider.
  </Card>

  <Card title="OneLogin" icon="shield">
    SAML 2.0. Enterprise SSO with role mapping support.
  </Card>
</CardGroup>

Any **SAML 2.0** or **OIDC**-compatible identity provider is supported. PingFederate, JumpCloud, Auth0, and custom IdPs all work.

## How it works

Dacard SSO is powered by [Clerk](https://clerk.com). Configuration is handled during enterprise onboarding you will not configure it directly in the app UI.

The setup process:

<Steps>
  <Step title="Contact support">
    Email [support@dacard.ai](mailto:support@dacard.ai?subject=SSO%20Setup) with your identity provider name and the email domain(s) to protect.
  </Step>

  <Step title="Configure your IdP">
    Our team sends you the Dacard SAML metadata URL or OIDC client credentials. You add a new application in your IdP using these values.
  </Step>

  <Step title="Verify the connection">
    Our team verifies the connection and enables SSO for your domain.
  </Step>

  <Step title="Enforce SSO">
    Once verified, you can enable **Enforce SSO**. All members on your domain must authenticate via your IdP. Email/password and social logins are disabled for your domain.
  </Step>
</Steps>

## Enforcing SSO

When SSO is enforced:

* All members with your email domain must sign in through your IdP
* Email/password logins are disabled for your domain
* Members who cannot authenticate through the IdP lose access
* New sign-ups on your domain are routed through your IdP automatically

<Warning>
  Enabling SSO enforcement immediately locks out any members who are not yet provisioned in your IdP. Confirm IdP provisioning is complete before enforcing.
</Warning>

## Combine with SCIM provisioning

SSO handles authentication. For automated user provisioning and deprovisioning, pair SSO with [SCIM](/knowledge-base/scim). Together they ensure that:

* New hires get Dacard access automatically when added in your IdP
* Departing employees lose access immediately when deactivated in your IdP
* No manual user management is needed in Dacard

## Requirements

| Requirement       | Detail                                                            |
| ----------------- | ----------------------------------------------------------------- |
| **Plan**          | Enterprise                                                        |
| **Configuration** | Handled by Dacard during onboarding                               |
| **Setup time**    | Typically 1-2 business days                                       |
| **Support**       | [support@dacard.ai](mailto:support@dacard.ai?subject=SSO%20Setup) |

<CardGroup cols={2}>
  <Card title="SCIM provisioning" icon="users-gear" href="/knowledge-base/scim">
    Automate user provisioning alongside SSO.
  </Card>

  <Card title="Plans & Billing" icon="credit-card" href="/knowledge-base/plans-billing">
    SSO is an Enterprise plan feature.
  </Card>
</CardGroup>