> For AI agents: the complete documentation index is available at /llms.txt, the full documentation bundle is available at /llms-full.txt.

# SSO

:::info

**Takeaways**

- SAML SSO is a paid feature available on the Business and Enterprise tiers.
- Users are provisioned on first login as organization members with no workspace access.
- An administrator then grants each user workspace roles.

:::

## Enabling SAML based SSO

To enable SAML based Single Sign On (SSO), your Tessl account manager or technical contact will provide a link for your SSO system to connect and configure Tessl.

Your account manager can also send a link to add and verify your company's email domains. Tessl sends users to your SSO provider when their email address is on a verified domain, so verify every domain your users sign in with.

## Signing in from your identity provider

Users can start a sign-in in two ways. Both end with the user signed in to Tessl:

- On Tessl, by entering their email address.
- From your identity provider's app dashboard, by clicking the Tessl app in Okta, Microsoft Entra ID, or Google Workspace.

For organizations on `tessl.io`, leave the RelayState setting in your identity provider empty.

For organizations in the [EU region](/administrators/eu-region.md), the app dashboard needs a RelayState that points the sign-in at `eu.tessl.io`. Without it, users clicking the app land on `tessl.io` instead. Set it to this value, as one string:

```text
client_id=client_01KVT17YZYVSBQWERPGER783ZD&redirect_uri=https://eu.tessl.io/auth/callback
```

Where to set it:

- **Okta:** the Tessl SAML app, then **General**, **SAML Settings**, **Default RelayState**.
- **Microsoft Entra ID:** the Tessl enterprise application, then **Single sign-on**, **Basic SAML Configuration**, **Relay State (Optional)**.
- **Google Workspace:** the Admin console, then **Apps**, **Web and mobile apps**, the Tessl SAML app, **Service provider details**, **Start URL**.

To check the setup, open a private browser window, sign in to your identity provider, and click the Tessl app. You land in Tessl, signed in.

A user who belongs to more than one organization lands on their default organization. They can change it under **Account settings**, in the **Defaults** section.

## Configuring Users

:::info

Users are provisioned on first login

:::

By setting up the integration, a user will authenticate via your SSO and be assigned the “member” role of the Organization when they visit Tessl. Your Tessl Org or Tessl Workspace administrators can add the user to workspaces with the desired roles by navigating to _**Settings → Members**_ in each workspace.

For information on setting roles and managing users, see:

- [Organizations, Workspaces, and Roles](/administrators/administrating-organizations-workspaces-and-roles.md)
- [Roles](/administrators/roles.md)