See the complete route index at https://docs.crusible.dev/llms.txt before following links.

# Set up single sign-on

Configure an organisation identity provider, test sign-in and activate the connection.

<!-- https://docs.crusible.dev/admin/single-sign-on/ · doctype: how-to · role: admin · reviewed: pending human review -->


You need organisation-owner access to **SSO** and permission to configure your identity provider.
The connection supports Microsoft Entra or Google with SAML or OpenID Connect.
Keep your current signed-in browser session open while testing a new connection.


1. <p>Open <strong>SSO</strong> at <code>/organisation/sso</code>. If a connection already exists, inspect its state before changing it.</p>
 (Result: SSO opens the current connection or the identity-provider choices.)

1. <p>Choose the provider and protocol that match your identity-provider configuration.
An organisation can have 1 active or draft connection. Repair the current connection through its own page.</p>
 (Result: Crusible creates a draft connection and opens its setup checklist.)

1. <p>Open <strong>Configure your identity provider</strong>. Follow the instructions for your chosen provider.
For SAML, supply the provider metadata using <strong>Metadata URL</strong> or <strong>Metadata XML</strong>.
For OpenID Connect, supply the client configuration requested on the page.
Use the callback values from your own connection rather than copying another organisation’s values.</p>
 (Result: The connection stores your provider configuration after validation.)

1. <p>Open <strong>Test the connection</strong>, then select <strong>Run the test</strong>. Sign in with an account authorised by your identity provider.
Return to the connection and check that the test passes.</p>
 (Result: The connection records the test result after the provider returns you to Crusible.)

1. <p>Open <strong>Activate</strong>. Read any domain-verification notice and complete any required acknowledgement.
Select <strong>Turn it on</strong> and check the resulting connection state.</p>
 (Result: Crusible activates the connection only after its checks succeed.)

- **If this doesn't work:** <p>If <strong>SSO</strong> is missing, ask the organisation owner to open it.
If the test fails or times out, read the reason on the connection page, correct the provider configuration and run the test again.
Changing configuration can invalidate later setup steps. A previous passing test provides no evidence that edited settings work.
If activation fails, keep the current session and resolve the displayed blocker before changing sign-in policy.
Keep client secrets, sign-in links and identity assertions out of channels.</p>





An active connection is the result of this procedure. An active connection can still reject individual accounts.
Test with an intended member before relying on the connection for their access.

## Reset an unwanted connection

**Reset** deletes the connection and its setup. Members lose that sign-in method.
For an active connection, select **Reset**, type `Reset` in **Confirmation**, and confirm only after checking the impact.
A draft resets immediately without that confirmation dialog.
Crusible can refuse reset when single sign-on remains required or an owner would lose their last sign-in method.
Read the refusal before changing any other access setting.

- [Roles and permissions](https://docs.crusible.dev/admin/roles-and-permissions/) — Organisation roles, settings access and the limits on changing another member’s access.- [Manage sign-in sessions](https://docs.crusible.dev/admin/manage-sign-in-sessions/) — Review your browser sessions and revoke access from a device you no longer use.