Configure Organization SAML SSO

This feature is available on Enterprise plans.

Set up SAML single sign-on (SSO) with an identity provider (IdP) for all teams in your organization.

Organization SSO offers a secure and streamlined way to manage access to your organization and supports many popular identity providers, including:

ADP
Auth0
Azure AD SAML
Duo
Google
LastPass
Okta
OpenID

Users who log in with Organization SSO must have an email address that matches their user ID in your identity provider. For example, a Netlify user with the email address jane@company.com must also have this exact email address in your identity provider. Organization SSO does not support multiple email domains for your users.

Best practices for setting up SSO

For better security, we recommend enforcing Organization SSO so that Owners, Developers, and Billing Admins must log in through your identity provider to access the Netlify app/dashboard.

If an Organization Owner does not enable strict SSO to enforce Organization SSO, then users can still log in to Netlify in different ways. For example, if Organization SSO is not enforced, then all Owners, Developers, and Billing Admins can log in to the Netlify app using any of the Netlify login options, including:

GitHub
GitLab
Bitbucket
a standard email
SAML SSO through an identity provider

If you don’t enforce Organization SSO, then users can log in with SSO or use their username and password to access a team in the organization. We recommend enforcing Organization SSO for the most secure experience.

To log in to Netlify with Organization SSO:

Navigate to your SSO login page with https://app.netlify.com/sso or by choosing Log in via SSO from the Netlify login page. Note that if you are newly invited to a team or organization, then you must accept the invite and verify your email address before you can log in to Netlify with SSO for the first time.
Enter a Netlify team ID for a team you have access to in the organization. This team ID may be a slug, such as test-team-2.
Netlify will redirect you to your identity provider’s login page. Follow the prompts there to complete your authentication.

Configure Organization SSO

As an Organization Owner, to set up a new Organization SSO connection with a supported identity provider:

Navigate to your Organization overview page. In the navigation, select the organization name and then select Organization overview.
Go to Access & security Organization SSO, and select Edit configuration.
Follow the guided flow to set up an Organization SSO connection with your preferred identity provider. We recommend testing your SSO connection after you set it up.

Once successfully configured, your team has the option to log in to Netlify and access your organization’s resources using Organization SSO. To require users to sign on to Netlify through your identity provider, you’ll need to enforce Organization SSO.

Enforce Organization SSO

As an Organization Owner, after you successfully set up SSO for your organization, you can enforce SSO login for all teams in your organization.

As soon as you successfully set up Organization SSO, any existing Team SSO settings are disabled automatically. Organization SSO overrides Team SSO and Team Owners can no longer manage SSO settings for their teams once Organization SSO is set up.

Once you set up Organization SSO and log in with SSO as an Organization Owner, you can enforce SSO login.

Once enforced, all Team Owners, Developers, and Billing Admins must use your Organization SSO configuration to access site configuration and team settings. Enforcing Organization or Team SSO does not apply to the Git Contributor Netlify role, since they cannot access your Netlify dashboard with team settings or site configuration.

Prepare to enforce Organization SSO

As an Organization Owner, you must log in using your Organization SSO connection before you can require this authentication for all teams in your organization.

To ensure consistent site access, ensure that everyone who needs access to your site or team settings already has an account with your identity provider. If inviting new Netlify users, learn more.

Once you log in using SSO at https://app.netlify.com/sso, follow these steps to enforce Organization SSO for all of your teams:

Navigate to your organization overview page. In the navigation, select the organization name and then select Organization overview.
On your organization settings page, go to Organization SSO, and select Edit login types.
Select Only SSO allowed (strict), then Save.

Now, anyone who wants to access your site or team settings must authenticate through your organization’s identity provider.

As an Organization Owner, you can reverse enforced Organization SSO at any time by selecting All login types allowed and confirming with Save.

Invite new users through Organization SSO

As an Organization Owner, you can invite new Netlify users to your organization and give them customized access to the Netlify app.

To invite a new user to access the Netlify app with Organization SSO enabled:

If you haven’t already, invite the user to your identity provider using the same email address that you will use to invite them to Netlify.

Navigate to your Organization overview page. In the navigation, select the organization name and then select Organization overview.
On your Organization overview page, under Teams, select the team you want to add the Netlify team member to.
Go to your team’s Members page, and select Add members.
Enter the email addresses for the people you want to add and select Continue. Note that while you can add more than one person at a time, you will only be able to give them the same role in the next step.
Choose one role for the new Netlify team members. You can choose from Team Owner, Developer, or Billing Admin. If you chose Developer, choose which sites they can access. Then, select Send invites.

New Netlify users will receive a confirmation email. After confirming their email address, they can log in with Organization SSO.

Manage your Organization SSO configuration

Once successfully configured, you can test your SSO connection, change your metadata configuration, or reset your SSO connection.

To change your Organization SSO configuration:

Navigate to your Organization overview page. In the navigation, select the organization name and then select Organization overview.
On your Organization settings page, go to Organization SSO, and select Edit configuration.
Use the SSO configuration portal to change your configuration.

Delete your Organization SSO configuration

If you want to use a different identity provider or default to any Team SSO settings, you can delete your Organization SSO configuration. If you would like to reset your SSO connection, consider managing your Organization SSO configuration.

To delete your Organization SSO configuration:

Navigate to your Organization overview page. In the navigation, select the organization name and then select Organization overview.
Go to Organization settings > Organization SSO and select Delete.

Did you find this doc useful?

Your feedback helps us improve our docs.