---
title: "Let your team log in with Single Sign-On (SSO)"
description: "Connect Okta, Microsoft Entra ID or any other SAML or OIDC provider and let your team log in with SSO. SCIM keeps your team members in sync."
url: "https://lettermint.co/changelog/log-in-with-single-sign-on-sso"
published: "2026-10-15"
last_updated: "2026-10-15"
---

# Let your team log in with Single Sign-On (SSO)

> Connect Okta, Microsoft Entra ID or any other SAML or OIDC provider and let your team log in with SSO. SCIM keeps your team members in sync.

In June, [passkeys](https://lettermint.co/changelog/login-with-passkeys) made
logging in to Lettermint more secure. Next up on our
[roadmap](https://lettermint.co/roadmap/sso) was Single Sign-On, this time
built for teams.
**Your team can now log in with Single Sign-On (SSO).**

With SSO, everyone logs in through your organization's
identity provider, such as Okta or Microsoft Entra ID.
New colleagues don't have to create a Lettermint account
or wait for an invite. They log in with their work email
and end up in your team right away. You decide who gets
access in your own identity provider. If you also use
SCIM, that is where you set which
[roles](https://lettermint.co/changelog/give-team-members-and-clients-the-right-access-rbac)
your team members get.

Plenty of providers keep SSO behind an expensive
enterprise contract. We see it as basic security, so
SSO is included in all our plans for teams.

## What is Single Sign-On (SSO)?

Single Sign-On (SSO) lets you use one account to log in
to multiple apps. You have probably done something
similar when signing in with Google or Microsoft. That
uses your personal account. With SSO through SAML or
OpenID Connect (OIDC), your organization manages the
accounts itself, in a central system called an identity
provider. That is where an admin decides which apps each
person can use.

Without SSO, people often create a separate account for
every tool, Lettermint included, each with its own email
address and password. When someone leaves the company,
an admin has to delete all of those accounts again.
Keeping track of that takes a lot of time, especially
when you have to go through every tool one by one.

With SSO, every account lives in your identity provider.
When you log in to Lettermint, the identity provider
checks whether you have access. Almost every identity
provider works with SAML or OIDC, and Lettermint
supports both.

## How it works

You set up SSO in your team settings in Lettermint.
That is where you connect your identity provider and add
your organization's domains, for example example.com.
For popular providers such as Okta, Microsoft Entra ID
and Google Workspace, our
[documentation](https://lettermint.co/docs/platform/teams/sso)
has a step-by-step guide. The same goes for European
providers like ZITADEL and cidaas. They pair well with
[European email](https://lettermint.co/european-email), since your login
data stays in Europe too. Using a different provider?
Then you connect it yourself through SAML or OIDC.

When a colleague then logs in with an email address on
one of those domains, Lettermint recognizes it. The
password field disappears, and **Continue with SSO**
takes them to the identity provider. After their first
login, they are part of your team with the Member role
and access to all projects. You can change that later
if needed.

## Manage team members automatically with SCIM

SCIM is a standard that lets your identity provider keep
track of who is in your Lettermint team. New colleagues
are added automatically. When someone leaves, SCIM
removes them from your team too. No more manual
bookkeeping in Lettermint. If you are
[ISO 27001 certified](https://lettermint.co/blog/lettermint-iso-27001-certified),
that is a nice bonus, because the standard requires you
to revoke access promptly when someone leaves.

Do you use groups in your identity provider, such as
Engineering or Support? You can map them to a role in
Lettermint, and everyone in that group gets that role.

Our
[documentation](https://lettermint.co/docs/platform/teams/scim)
shows how to set up SCIM.

## Available now

As we mentioned at the start, SSO is included in all our
[plans for teams](https://lettermint.co/pricing). The same goes for SCIM.
You will find both in your team settings. Anyone with a
role that has the **Manage team security** permission
can set them up.

Need to pause SSO for a while, for example when you
switch to a different identity provider? You can turn
the connection off temporarily. Your configuration is
saved, so you can turn it back on later without starting
over.