Back to overviewIn June, passkeys made logging in to Lettermint more secure. Next up on our roadmap was Single Sign-On, this time built for teams. Your team can now log in with Single Sign-On (SSO).
With SSO, everyone logs in through your organization's identity provider, such as Okta or Microsoft Entra ID. New colleagues don't have to create a Lettermint account or wait for an invite. They log in with their work email and end up in your team right away. You decide who gets access in your own identity provider. If you also use SCIM, that is where you set which roles your team members get.
Plenty of providers keep SSO behind an expensive enterprise contract. We see it as basic security, so SSO is included in all our plans for teams.
What is Single Sign-On (SSO)?
Single Sign-On (SSO) lets you use one account to log in to multiple apps. You have probably done something similar when signing in with Google or Microsoft. That uses your personal account. With SSO through SAML or OpenID Connect (OIDC), your organization manages the accounts itself, in a central system called an identity provider. That is where an admin decides which apps each person can use.
Without SSO, people often create a separate account for every tool, Lettermint included, each with its own email address and password. When someone leaves the company, an admin has to delete all of those accounts again. Keeping track of that takes a lot of time, especially when you have to go through every tool one by one.
With SSO, every account lives in your identity provider. When you log in to Lettermint, the identity provider checks whether you have access. Almost every identity provider works with SAML or OIDC, and Lettermint supports both.
How it works
You set up SSO in your team settings in Lettermint. That is where you connect your identity provider and add your organization's domains, for example example.com. For popular providers such as Okta, Microsoft Entra ID and Google Workspace, our documentation has a step-by-step guide. The same goes for European providers like ZITADEL and cidaas. They pair well with European email, since your login data stays in Europe too. Using a different provider? Then you connect it yourself through SAML or OIDC.
When a colleague then logs in with an email address on one of those domains, Lettermint recognizes it. The password field disappears, and Continue with SSO takes them to the identity provider. After their first login, they are part of your team with the Member role and access to all projects. You can change that later if needed.
Manage team members automatically with SCIM
SCIM is a standard that lets your identity provider keep track of who is in your Lettermint team. New colleagues are added automatically. When someone leaves, SCIM removes them from your team too. No more manual bookkeeping in Lettermint. If you are ISO 27001 certified, that is a nice bonus, because the standard requires you to revoke access promptly when someone leaves.
Do you use groups in your identity provider, such as Engineering or Support? You can map them to a role in Lettermint, and everyone in that group gets that role.
Our documentation shows how to set up SCIM.
Available now
As we mentioned at the start, SSO is included in all our plans for teams. The same goes for SCIM. You will find both in your team settings. Anyone with a role that has the Manage team security permission can set them up.
Need to pause SSO for a while, for example when you switch to a different identity provider? You can turn the connection off temporarily. Your configuration is saved, so you can turn it back on later without starting over.