Single sign-on lets your team sign in to Teaflask through your identity provider using SAML. Setup requires **Enterprise** access, an **owner**, and a work-email domain you can verify through DNS.

Manage it under **Settings > Domains & SSO**. You will also need access to your DNS host and your identity provider's SAML settings.

## Verify your work-email domain

Work-email domains appear automatically as teammates sign up and join. This initial association helps people find your organization and [request membership](/members), but it does not prove that you control the domain or enable SAML. Public email-provider domains cannot be claimed as company domains.

To verify ownership:

1. Choose **Manage** beside the domain, then **Verify via DNS**.
2. Add the displayed TXT record at your DNS host, using the exact name and value.
3. Return to Teaflask and check the record.

The challenge is valid for **72 hours**. Reopening the dialog preserves an unexpired challenge. If it expires, use the newly issued value. DNS changes may take time to become visible.

A DNS-verified domain is exclusive across Teaflask. Another organization cannot claim it, and new users on that domain are directed to your organization rather than creating another one.

## Connect your identity provider

Under **SAML connections**, choose **Register**. Each DNS-verified domain can have one connection.

1. Copy the **ACS URL** and **SP entity ID** from the dialog into your identity provider's SAML application settings.
2. Provide your identity provider's **metadata URL** or paste its **metadata XML** into Teaflask.
3. Complete registration. The optional identity-provider entity ID is read from the metadata if you leave it empty.

Successful registration activates the connection without a separate manual provisioning step. Test signing in through your identity provider before requiring SSO for the domain.

### Automatic membership

New users with verified email addresses on an actively connected domain join the organization automatically as members. Existing members keep their roles.

This uses the email domain, not the sign-in method. It does not by itself require users to authenticate through SAML.

## Require SSO

Enable **Require SSO** on the active connection to require non-owner users on that domain to use your identity provider.

Email-code and Google sign-ins are then refused for those users. Existing non-SSO sessions are signed out on their next action, so Teaflask asks you to confirm the change.

Owners retain email-code and Google sign-in as a recovery path. Check that you have a usable owner sign-in before enabling enforcement.

Turning the requirement off applies immediately and allows those other sign-in methods again.

## Disable or remove access

**Disable** turns off the connection and its SSO requirement. Existing members remain members and can use email-code or Google sign-in again. Re-enabling the connection uses its stored metadata and requires Enterprise access. If **Domains & SSO** is unavailable after a plan change, contact [Support](/support) to manage the existing connection.

**Remove** on a domain removes its association with the organization. For a DNS-verified domain, this also disables its SAML connection and releases the exclusive claim, allowing another organization to claim it. Removed domain associations are not automatically added back.

**Removing a domain does not remove existing organization members.**

For sign-in and verification errors, see [Administration troubleshooting](/troubleshooting-administration).