> For the complete documentation index, see [llms.txt](https://knowledgebase.fabricdata.com/studio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.fabricdata.com/studio/admin-and-configuration/single-sign-on-sso.md).

# Single Sign-On (SSO)

Single Sign-On (SSO) lets you manage your team’s access to Origin Studio through your preferred Identity Provider (IdP). It improves security by centralising authentication and simplifies login for your users.

**Platform:** Origin Studio's authentication is powered by Auth0, ensuring enterprise-grade security and compatibility with industry-standard SAML 2.0 providers.

**Note:** SSO is generally available on Enterprise plan. 

***

{% stepper %}
{% step %}

### Initial Admin Access

Before enabling SSO, an initial Admin must set up the environment.

1. **Invite the Admin:** The primary Administrator is invited via a standard email/password link.
2. **Account Setup:** Complete the initial workspace setup (Company name, branding, etc.) while logged in with standard credentials.
   {% endstep %}

{% step %}

### Configuration & IT Collaboration

3. **IT Collaboration:** Share your platform’s ACS URL and Entity ID (found in Security Settings) with your IT team. They will use these to create the application in your IdP (e.g., Okta, Azure AD, Google Workspace). [View detailed IdP configuration guide](/studio/admin-and-configuration/single-sign-on-sso/sso-technical-configuration-reference.md).
4. **Integration:** Once your IT team provides the Metadata URL or XML file from your IdP, enter these details into the Origin Studio SSO configuration panel.
   {% endstep %}

{% step %}

### Activation & Validation

{% hint style="info" %}
**Warning:** Enabling SSO deactivates all existing user passwords in favor of your IdP.
{% endhint %}

* **Enable SSO:** Toggle the "Enable SSO" switch in your settings.
* **Immediate Access:** Users are now redirected to your company’s login portal when accessing Origin Studio.
* **Validation:**
  * Confirm that the "Log in with Password" option is no longer visible or functional for standard users.
  * Test the redirect to ensure user emails correctly map to their workspace.
    {% endstep %}
    {% endstepper %}

<details>

<summary>Frequently Asked Questions</summary>

**What happens to existing passwords?**\
Once SSO is activated, Origin Studio no longer stores or accepts user passwords. All authentication is handled by your company's Identity Provider through Auth0's secure integration layer.

**Can we use hybrid login (SSO + Password)?**\
By default, SSO is enforced for all users to maximize security. For specific use cases such as service accounts or external guest access, please contact support to discuss available options.

**What happens if our IdP experiences downtime?**\
We strongly recommend designating at least one **Emergency Admin** with a secure recovery method or bypass credential to prevent complete account lockout. Contact support to configure emergency access protocols.

**Which Identity Providers are supported?**\
Origin Studio supports any SAML 2.0 compliant provider through our Auth0-powered authentication infrastructure, including Okta, Microsoft Azure AD (Entra ID), Google Workspace, and custom enterprise IdPs.

</details>