Manage single sign-on

Verify company domains, connect an identity provider, and choose how members join and sign in.

Open SSO & Domains in Settings. The Account Owner or an Account Administrator can manage domains, SSO, provisioning, and account security.

SSO is available on Enterprise plans. You can verify domains and manage native joining without an SSO connection. For a reference to every card, switch, and action, see SSO & Domains.

Review your account overview

The overview shows verified domains, how people join, and seats in use. Use Manage domains, Manage joining, or View users to open the relevant controls. Pending invitations occupy seats; revoked members and pending access requests do not.

Getting started walks through domain verification, SSO setup, and testing. Email invitations do not require a verified domain.

Before you begin

To use SSO, your company needs an identity provider, such as Google Workspace, that can connect to WorkOS. An administrator of that provider must authorize and configure the connection. If another team manages your identity provider, share the setup details shown in WorkOS with that team. You can verify a domain without setting up SSO, but verification alone does not let people sign in through the provider.

Keep an existing account administrator able to sign in while you complete setup. Require single sign-on starts Off; existing members can continue using their GovTribe credentials until you turn it on.

Verify a domain and offer your account

Domain verification confirms ownership. Let coworkers find this account offers your account to new people registering with that email domain. Join automatically determines whether those people can join without an invitation. Each setting has a separate purpose.

Add your company's domain. Under Company domain, enter a domain such as example.com and select Add domain. Enter the domain itself, without an email address or https://. If another account already claims it, contact Customer Success to resolve ownership.

Verify ownership. Select Verify domain in the domain's row and follow the instructions in WorkOS. Share those instructions with the person who manages your company's domain if needed. Return to SSO & Domains and reload the page to check for Verified. If available, Refresh status also checks domain verification.

Choose whether to offer the account. Turn Let coworkers find this account On for the verified domain. An unverified domain cannot be made Discoverable. The switch saves automatically.

Choose how people join. Under How people join, keep Invite only to require an administrator invitation, or select Join automatically to allow verified people to join when a seat is available. JIT remains unavailable until a verified domain is Discoverable.

These steps work without connecting an identity provider. With SSO optional or not configured, native applicants provide their name, email, mobile phone number, and password, then verify their phone and email. Verification of the company domain does not verify an individual applicant's identity.

Set up SSO

Verify a domain. Complete domain verification first. Connecting SSO and requiring it are separate choices.

Connect your identity provider. Under Single Sign On, select Set up SSO and complete provider setup with your identity provider administrator. WorkOS supplies the details that administrator needs, such as the SAML ACS URL and service provider Entity ID. The administrator supplies the provider's configuration to WorkOS and enables access for the intended users. Return to GovTribe and select Refresh status until the connection shows Connected. Use Let coworkers find this account under Domains to offer the account to people registering with that domain.

Test SSO as an administrator. Select Test sign-in and complete sign-in through your identity provider. Last SSO sign-in shows the most recent successful sign-in by any member; an account administrator must complete a test before SSO can be required for everyone.

An active connection, verified domain, and successful administrator SSO login are all required before you can turn on required SSO.

With Require single sign-on set to Off, members with GovTribe credentials can use them. New people on a discoverable, verified domain can choose to join during registration when JIT is enabled. They verify their email and phone with GovTribe before joining or requesting access; an active SSO connection is not needed. If a connection is active, they can also choose SSO. People created through SSO without a GovTribe password continue using SSO.

With required SSO On, joining and signing in require successful identity provider authentication. An unavailable connection blocks access. A new person can create a separate GovTribe account only when Block separate accounts is Off; that separate account does not grant access to your account.

For a new person on a verified, Discoverable domain with JIT enabled:

SSO setting	A seat is available	The account is full
No SSO connection	Join with email and password after phone and email verification.	Complete verification, then wait for administrator approval and a seat.
SSO optional, native joining selected	Join with email and password after phone and email verification.	Complete verification, then wait for administrator approval and a seat.
SSO optional, Join with SSO selected	Sign in through the provider to join; no GovTribe password or phone verification is needed.	Authenticate through the provider, then wait for administrator approval and a seat.
SSO required	Use the primary Join with SSO action. Native joining is unavailable.	Authenticate through the provider, then wait for administrator approval and a seat.

With required SSO and separate account creation restricted, registration shows the SSO action without a native form. If separate account creation is allowed, that choice creates a different account and does not bypass the original account's SSO requirement.

When Let coworkers find this account is Off, new people are not offered that account through registration. When Invite only is selected, discovery does not let an uninvited person join or submit an access request. Existing members and invited people can still use their permitted sign-in method when the account is full.

Under Security, Stay signed in for starts at GovTribe default: password sign-ins and Remember me keep their normal behavior, and SSO sign-ins expire after 14 days. Connecting SSO or verifying a domain does not change password sessions. Choosing 1, 7, or 14 days applies that period to all members. Returning to GovTribe default restores normal password sessions. Sessions can end sooner after inactivity.

To require SSO for every member, turn on Require single sign-on under Single Sign On. The switch saves automatically. Existing password sessions are signed out on their next request, so members must sign in through SSO. Turn the switch off on the same page to allow GovTribe credentials again.

People who joined through SSO without a GovTribe password continue using SSO even after the account makes SSO optional. A GovTribe password reset does not create a password for them. Members with an existing GovTribe password can keep using and resetting it when SSO is optional, including after they link their profile to SSO.

Check provider access before requiring SSO

Make sure every member who needs GovTribe access is enabled for the application in your identity provider. Turning on required SSO changes sign-in for the whole account.

Manage new members and seats

Under How people join, Invite only is the starting mode. Account managers add people using email invitations. When the account requires SSO, the invitation opens a primary Accept invitation with SSO action without asking for a password. Other invited members set a password. An invited member who first accepts through SSO without a GovTribe password continues using SSO. An uninvited person cannot join the account or create an access request.

Select Join automatically to admit new users automatically when a seat is available. The selection saves automatically. JIT requires a discoverable, verified domain. It works with GovTribe email and phone verification when SSO is optional, or with successful SSO when SSO is required.

If the account is full, GovTribe creates an access request only after verifying the person’s identity and notifies account managers. The sign-in notice tells the person whether their request needs review or has already been approved. An approved request still waits for an available seat. Pending applicants do not use a seat. Open Users and review Waiting to join. Make a seat available and approve the request; these can be done in either order. A free seat alone does not admit someone with an outstanding request.

Approval emails the person a link to sign in and join using the account’s current sign-in requirements. It does not reserve a seat or add the person immediately. Dismiss closes the request without emailing the person. A later sign-in attempt opens a dismissed request for review again.

Make a seat available. Open Users to use an empty seat or buy another seat, or contact Sales if your account cannot add seats directly. A canceled or unsuccessful purchase does not add capacity.

Approve the request. Open Users, find Waiting to join, and select Approve for the pending applicant. You can approve while the account is full, but the person still needs an available seat to join. If you switched to Invite only, invite the person from Users instead.

Ask the person to sign in. The approval email includes a sign-in link with their email filled in. They use their existing password or SSO, according to the current account requirement. GovTribe checks for a seat again before adding them.

Under Security, Block separate accounts prevents new personal GovTribe accounts from being created with email addresses on your verified domains. It requires at least one verified domain and works independently of SSO connection status or the Let coworkers find this account switches. Existing members and invited people can still sign in. New people can use the permitted JIT join or access-request option; the restriction prevents creating a separate account. This setting starts Off; while it is Off, a new person on a discoverable domain can create a separate GovTribe account from Sign Up. The switch saves automatically.

To release a domain claim, select Remove in its row and confirm. This also removes that organization's domain verification in WorkOS. You cannot remove the last verified domain while required SSO or account-creation restriction is on. While JIT is on, you cannot remove or turn off Let coworkers find this account for the last discoverable, verified domain. Select Invite only first.

An existing GovTribe user in another account is not moved automatically by domain registration or SSO. Members already linked to SSO cannot move between accounts through an account-transfer invitation; contact Customer Success if they need access to a different account.

If your identity provider changes a linked member's email address, GovTribe updates it after that member successfully signs in with the same SSO identity, provided the new address is unused and its domain is verified for your account. If the domain is not Discoverable, the member can start that first sign-in with their previous email address. Contact Customer Success if the new domain is not verified, the new address is already in use, or the member cannot start sign-in.

To remove an existing SSO member's GovTribe access, use Revoke access on Users. This releases their seat and blocks future GovTribe sign-in without changing their identity provider assignment. Account managers can restore a revoked member when a seat is available; that person returns as a User and signs in again under the current account policy. See Manage GovTribe users and invites.

An SSO-linked email is read-only on My profile. A pending native email change is canceled when an existing member first links SSO; use the identity provider for future email changes. GovTribe can update a linked email on the next successful SSO sign-in when the new address is unused and its domain is verified for the account.

Your name remains editable in GovTribe. A new SSO profile uses the name supplied by the provider, but later SSO sign-ins do not overwrite your GovTribe display name. GovTribe password and two-factor controls are unavailable when the account requires SSO or your profile has only an SSO login.

If the connection still shows Not connected, ask your identity provider administrator to confirm that the application is configured and users have access, then select Refresh status.
If the domain shows Not verified, select Verify domain, complete the verification steps in WorkOS, and refresh SSO status.
If Require single sign-on is unavailable, finish the connection, domain verification, and administrator sign-in test first.
If someone sees an invitation-required message, invite that person or choose JIT provisioning if automatic admission is intended.
If a person is asked for an invitation during registration, invite them or enable JIT with a discoverable, verified domain. Account-creation restrictions still prevent a separate account.
If a JIT sign-in creates a seat-limit request, add a seat and review the request before asking the person to sign in again.
If a member sees an access-revoked message, an Account Owner or Administrator can restore them on Users after making room for their seat. Their identity provider must also allow the sign-in.

For other account access issues, see Troubleshoot GovTribe account access.

Users: Manage seats, invitations, and requests to join.
SSO & Domains: Look up each domain, connection, admission, and security control.
Manage GovTribe users and invites: Manage invitations, account roles, and existing users.
Troubleshoot GovTribe account access: Resolve other sign-in and invitation problems.

On this page