> ## Documentation Index
> Fetch the complete documentation index at: https://docs.get2dial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Require single sign-on

> Connect an OIDC identity provider so your team signs in through your existing SSO, and optionally require it.

Connect your identity provider so your team signs in with their existing company credentials
instead of a Get2Dial password.

## Before you start

* You need an **admin** role.
* Get2Dial connects to any identity provider that speaks **OIDC** (OpenID Connect) — Okta, Azure
  AD, Google Workspace, and similar providers all work this way. SAML is not supported.
* From your identity provider, you need an **issuer URL**, a **client ID**, and a **client
  secret** for an application you register there.

## Steps

<Steps>
  <Step title="Register Get2Dial as an application with your identity provider">
    Use `https://app.get2dial.com/api/v1/auth/sso/callback` as the redirect URI when your
    provider asks for one.
  </Step>

  <Step title="Go to Settings">
    In Get2Dial, select your name, then **Settings**, then **Organization**.
  </Step>

  <Step title="Enter your connection details">
    Under **Single sign-on**, enter the **Issuer URL**, **Client ID**, and **Client secret**
    from your identity provider.
  </Step>

  <Step title="Map groups to roles">
    Enter the claim your provider sends group membership under (`groups` by default), then map
    each group value to a Get2Dial role. Set a **Default role** for anyone who signs in without
    a matching group — new accounts are created automatically on their first SSO sign-in.
  </Step>

  <Step title="Enable the connection">
    Turn on the connection and select **Save**.
  </Step>

  <Step title="Require SSO for your workspace, if you're ready">
    Turn on **Require single sign-on**. Password sign-in is then rejected for everyone except
    platform staff.
  </Step>
</Steps>

## Verify

<Check>
  Sign out and go to `app.get2dial.com`. You're redirected to your identity provider, and
  signing in there returns you to your workspace.
</Check>

## Common problems

* **A user signs in but lands with the wrong role.** Check their group membership at the
  identity provider against your role mapping — the mapping is evaluated on every SSO sign-in,
  so a group change takes effect the next time they sign in.
* **You turned on "Require single sign-on" and got locked out.** Contact support — see
  [Contact support](/troubleshooting/contact-support).

## Next steps

<CardGroup cols={2}>
  <Card title="Turn on multi-factor authentication" href="/account/multi-factor-authentication" />

  <Card title="Set a session policy" href="/account/session-policy" />
</CardGroup>