# Set up single sign-on and provisioning

> Connect your identity provider with SAML or OIDC, verify your domain, require SSO, and let SCIM add and remove people for you.

With single sign-on, your people sign in to Dvina through your company's identity provider, such as Okta, Microsoft Entra ID or Google Workspace. With provisioning (SCIM), your directory adds and removes people, and its groups become teams.

Single sign-on, provisioning and sign-in rules come with the Enterprise plan. Owners and admins set them up in Settings › **Security**.

## Add an identity provider

1. Open Settings and choose **Security**.
2. Under **Single sign-on**, choose **Add Identity Provider**.
3. Choose a **Protocol**: **SAML 2.0** or **OIDC**.
4. Enter the **Domain** your people's email addresses use, like company.com.
5. Under **Details**, enter what your identity provider gives you:
    - For SAML 2.0: the **Entity ID**, the **Sign-In URL** and the **Metadata XML**.
    - For OIDC: the **Issuer URL**, the **Client ID** and the **Client secret**.
6. Choose **Add**.

The provider shows as **Not Verified** until you verify its domain.

## Verify your domain

A provider signs nobody in until its domain is verified.

1. In Settings › **Security**, choose the provider.
2. Under **Verify Domain**, copy the record's **Name** and **Value**.
3. Add them as a TXT record in your domain's DNS.
4. Choose **Check Record**. It can take a few minutes for the record to be found.

When it's found, the provider shows **Verified**.

## How people join

When someone at your verified domain signs in with SSO for the first time, Dvina adds them to your Livespace. Choose the role they get in **New People Join As**: **Member** or **Admin**.

Each person who joins takes a seat. When every seat is taken, they can't join until you add seats.

## Require SSO

Once a domain is verified, you can make single sign-on the only way in.

1. In Settings › **Security**, turn on **Require SSO**.
2. Choose **Require SSO** to confirm.

Members with a verified domain must sign in with SSO from then on. Owners can still sign in another way.

> [!NOTE]
> To remove your last verified identity provider, turn off **Require SSO** first.

## Set up provisioning (SCIM)

1. In Settings › **Security**, under **Provisioning (SCIM)**, choose **Create SCIM Token**.
2. Copy the token and paste it into your identity provider, with the **SCIM Base URL**. You won't see the token again.

From then on, your identity provider keeps the Livespace in step with your directory:

- A person it adds becomes a member, with the role in **New People Join As**.
- Each group it sends becomes a team.
- When it deactivates or removes someone, they leave the Livespace and their access ends at once. The reports they built go to someone on the team.
- Fields such as department, cost_center, division, organization, employee_number, title and user_type come from your identity provider as member attributes.

To replace the token, choose it, then choose **Rotate Token**. The current token stops working at once, so paste the new one into your identity provider. To stop provisioning, choose **Revoke Token**.

## Other sign-in rules

The **Sign-In** group on the same page sets two-step verification, how long sessions last and the networks people may sign in from.

### Require two-step verification

1. In Settings › **Security**, under **Sign-In**, turn on **Require Two-Step Verification**.
2. Choose **Require** to confirm.

Members without it set up an authenticator app the next time they sign in.

### Set how long sessions last

Under **Sign-In**, choose:

- **Sign-In Lasts**: how long a sign-in stays valid before people sign in again. It's **30 days** unless you choose **7 days**, **1 day**, **12 hours**, **8 hours** or **1 hour**.
- **Sign Out When Idle**: how long a device may sit unused before it's signed out. It's **Never** unless you choose **7 days**, **1 day**, **8 hours**, **1 hour** or **15 minutes**.

### Limit sign-in to your networks

**Allowed Networks** shows **Everywhere** until you add a network.

1. Under **Sign-In**, choose **Allowed Networks**.
2. In **IP addresses and ranges**, enter one address or range per line, like 203.0.113.0/24.
3. Choose **Save**, then **Limit Access** to confirm.

People outside these networks lose access at once, including you if your network isn't listed. To allow every network again, leave the list empty and save.

## Good to know

- Every change to single sign-on and provisioning is recorded in the [audit log](/docs/teams/audit-log).
- Passkeys work too.

## Related

- [Members and roles](/docs/teams/members-and-roles)
- [Audit log](/docs/teams/audit-log)
- [Dvina for teams and companies](/docs/teams/overview)
- [Enterprise](/solutions/enterprise)