> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-On > Let users sign in to StackOne through your organization's SAML identity provider. StackOne Single Sign-On (SSO) lets the organization's users sign in through its own SAML 2.0 identity provider (IdP). StackOne acts as the SAML service provider (SP), and the IdP authenticates users. Each organization has one SSO connection, bound to one email domain. Once that domain is verified, anyone whose work email is on it signs in through the IdP instead of with a StackOne password. They can start from the StackOne sign-in page by entering their email, or open the StackOne app from the IdP. Signing in with SSO doesn't add anyone to the organization. To add users, see [Manage Team](/secure/identity-and-access/manage-team/overview). ## Set up an SSO connection The guide for your SAML IdP takes you through each part of the setup: * Creating the SAML app in the IdP. * Registering it in StackOne. * Verifying the domain. * Managing the connection afterward. ## Require SSO Once the domain is verified, you can require users to sign in through SSO and turn off email and password sign-in. Enforcing doesn't check that sign-in works. A misconfigured SAML app, an unassigned user, or a certificate or issuer mismatch still enforces, and **anyone the IdP can't authenticate is locked out**. Before you enforce, open a private or incognito window and complete an SSO sign-in as a user assigned to the app in the IdP, not only your own account. 1. Go to [**Organization > Security > Authentication**](https://app.stackone.com/organization/security/authentication). 2. On the **Enforcement Policy** card, select **Edit policy**. 3. Add the SAML connection to **Enforced methods**. 4. Select **Save changes**. The Enforcement Policy panel under Organization > Security > Authentication, where you add the SSO connection to the enforced sign-in methods. Enforcement takes effect as soon as you save. Anyone whose session didn't come through an enforced method, including you, is asked to sign in through the IdP the next time they load a page or switch to the organization. Locked out after enforcing? An **Organization Admin** who can still reach the dashboard can remove the method from the **Enforcement Policy** to restore password sign-in. If no one can get in, contact StackOne support. ## Next steps Add users who aren't members yet when they sign in, and map an attribute to organization admin. Provision and deactivate members automatically from the IdP. Grant many members the same project or account access at once. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.