Skip to main content
Everything on this page is an Enterprise capability. On other plans, sign-in is email/password or social login (Google, Microsoft, Apple) — see Plans for the full comparison.

​
Single sign-on

Tied supports both SAML and OIDC, across 20+ identity providers — Okta, Azure AD / Entra ID, Google Workspace, JumpCloud, OneLogin, Auth0 and Ping among them.
Your identity provider issues a metadata document (or a metadata URL) and a signing certificate. Tied uses it to trust assertions from your IdP, so signing in to Tied is signing in to your IdP — there’s no separate Tied password for anyone using SSO.
Setup is self-serve through an Admin Portal, rather than a back-and-forth with a Tied engineer for every change. Your own IT admin connects the provider, maps attributes, and can update the connection later without opening a support ticket.

​
SCIM and directory sync

Once SSO is connected, SCIM keeps membership in sync automatically: add someone to the right group in your IdP and they get a Tied account; remove them, and their access ends without anyone visiting Settings → Members and teams by hand. See Users and roles for how that same access looks when it’s managed manually instead.

​
Enforced MFA

Administrators can require multi-factor authentication for every member of the account, not just the people who’d opt in on their own. Once enforced, a member who hasn’t set up MFA is prompted to before they can do anything else. The factor is a TOTP authenticator app, with one-time backup codes for recovery.
This is distinct from personal MFA, which any individual can turn on for their own login today, on any plan. Enforcement — making it mandatory account-wide — is the Enterprise piece. See Security.

​
Getting set up

1

Confirm your plan

SSO, SCIM and enforced MFA are Enterprise-only. Talk to your account team if you’re not there yet.
2

Open the Admin Portal

Your account team provisions access.
3

Connect your identity provider

SAML metadata, or an OIDC client ID and secret — whichever your IdP uses.
4

Pilot with a small group before rolling out

Confirm attribute mapping and role assignment behave the way you expect before every member is routed through SSO.
5

Turn on SCIM and enforced MFA

Independently of each other, and independently of SSO itself — you can run SSO alone if that’s all you need.

​
Next

Security

Encryption, subprocessors, and where compliance certifications actually stand.

Users and roles

How access works when it’s managed by hand instead of SCIM.