For AI agents: the complete documentation index is available at /llms.txt, the full documentation bundle is available at /llms-full.txt, and this page is available as Markdown at /administrators/sso.md.
Docs

    SSO

    Info

    Takeaways

    • SAML SSO is a paid feature available on the Business and Enterprise tiers.
    • Users are provisioned on first login as organization members with no workspace access.
    • An administrator then grants each user workspace roles.

    Enabling SAML based SSO

    To enable SAML based Single Sign On (SSO), your Tessl account manager or technical contact will provide a link for your SSO system to connect and configure Tessl.

    Your account manager can also send a link to add and verify your company's email domains. Tessl sends users to your SSO provider when their email address is on a verified domain, so verify every domain your users sign in with.

    Signing in from your identity provider

    Users can start a sign-in in two ways. Both end with the user signed in to Tessl:

    • On Tessl, by entering their email address.
    • From your identity provider's app dashboard, by clicking the Tessl app in Okta, Microsoft Entra ID, or Google Workspace.

    For organizations on tessl.io, leave the RelayState setting in your identity provider empty.

    For organizations in the EU region, the app dashboard needs a RelayState that points the sign-in at eu.tessl.io. Without it, users clicking the app land on tessl.io instead. Set it to this value, as one string:

    client_id=client_01KVT17YZYVSBQWERPGER783ZD&redirect_uri=https://eu.tessl.io/auth/callback

    Where to set it:

    • Okta: the Tessl SAML app, then General, SAML Settings, Default RelayState.
    • Microsoft Entra ID: the Tessl enterprise application, then Single sign-on, Basic SAML Configuration, Relay State (Optional).
    • Google Workspace: the Admin console, then Apps, Web and mobile apps, the Tessl SAML app, Service provider details, Start URL.

    To check the setup, open a private browser window, sign in to your identity provider, and click the Tessl app. You land in Tessl, signed in.

    A user who belongs to more than one organization lands on their default organization. They can change it under Account settings, in the Defaults section.

    Configuring Users

    Info

    Users are provisioned on first login

    By setting up the integration, a user will authenticate via your SSO and be assigned the “member” role of the Organization when they visit Tessl. Your Tessl Org or Tessl Workspace administrators can add the user to workspaces with the desired roles by navigating to Settings → Members in each workspace.

    For information on setting roles and managing users, see: