SSO Configuration

About SSO

Single Sign-On (SSO) allows your team members to log into Twenty using your organization's identity provider. This provides:

• Centralized access control: Manage access from one place
• Enhanced security: Leverage your existing security policies
• Better user experience: One set of credentials for all tools

Supported Providers

Twenty supports SSO with:

• SAML 2.0: Works with most enterprise identity providers
• Google Workspace: For organizations using Google
• Microsoft Entra ID: (formerly Azure AD) For Microsoft environments

Setting Up SSO

Prerequisites

• Organization plan (cloud and self-hosted workspaces)
• Admin access to your identity provider
• Admin access to Twenty workspace

<Note> **For self-hosting users willing to set up SSO**, reach out to [email protected] </Note>

Configuration Steps

1. Access SSO Settings

1. Go to Settings → Security
2. Find the SSO Configuration section
3. Click Configure SSO

2. Choose Your Provider

Select your identity provider from the list or choose "Custom SAML" for other providers.

3. Configure Your Identity Provider

You'll need to configure your identity provider with:

• Entity ID: Provided by Twenty
• ACS URL: The callback URL for authentication
• Certificate: For secure communication

4. Enter Provider Details in Twenty

• SSO URL: Login URL from your provider
• Entity ID: Your provider's identifier
• Certificate: X.509 certificate from your provider

5. Test and Enable

1. Click Test Configuration to verify setup
2. Enable SSO when testing is successful
3. Configure user provisioning preferences

User Provisioning

Just-in-Time (JIT) Provisioning

• Users are created automatically on first login
• Assigned default role automatically
• No manual user creation needed

Manual Provisioning

• Invite users before they can log in
• Pre-assign specific roles
• More control over who can access

Managing SSO Users

Role Assignment

SSO users can be assigned roles like regular users:

1. Go to Settings → Members
2. Find the user
3. Change their role as needed

Access Revocation

To remove access for SSO users:

• Remove them from your identity provider, or
• Remove them from the Twenty workspace

Best Practices

Security

• Require SSO: Disable password login for SSO users
• Regular audits: Review access periodically
• Strong IdP policies: Enforce MFA at the identity provider

User Management

• Clear naming: Use consistent naming from your directory
• Group mapping: Map IdP groups to Twenty roles (if available)
• Offboarding process: Include Twenty in your deprovisioning workflow

Troubleshooting

Common Issues

• Certificate errors: Ensure certificate hasn't expired
• URL mismatches: Verify ACS URL matches exactly
• User not found: Check JIT provisioning settings

Getting Help

If you encounter issues, contact support with:

• Error messages received
• Identity provider being used
• Configuration details (without sensitive data)