> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tied.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO and SCIM

> SAML, OIDC, directory sync and enforced MFA.

<Info>
  **Everything on this page is an Enterprise capability.** On other plans, sign-in is email/password or
  social login (Google, Microsoft, Apple) — see [Plans](/pricing/plans) for the full comparison.
</Info>

## Single sign-on

Tied supports both SAML and OIDC, across 20+ identity providers — Okta, Azure AD / Entra ID, Google Workspace, JumpCloud, OneLogin, Auth0 and Ping among them.

<Tabs>
  <Tab title="SAML">
    Your identity provider issues a metadata document (or a metadata URL) and a signing certificate.
    Tied uses it to trust assertions from your IdP, so signing in to Tied is signing in to your IdP —
    there's no separate Tied password for anyone using SSO.
  </Tab>

  <Tab title="OIDC">
    Your identity provider gives you a client ID, client secret and issuer URL. Functionally
    equivalent to SAML for sign-in purposes — pick whichever your IdP supports better, or whatever
    your team already standardizes on.
  </Tab>
</Tabs>

Setup is self-serve through an **Admin Portal**, rather than a back-and-forth with a Tied engineer for every change. Your own IT admin connects the provider, maps attributes, and can update the connection later without opening a support ticket.

## SCIM and directory sync

Once SSO is connected, SCIM keeps membership in sync automatically: add someone to the right group in your IdP and they get a Tied account; remove them, and their access ends without anyone visiting Settings → Members and teams by hand. See [Users and roles](/admin/users) for how that same access looks when it's managed manually instead.

## Enforced MFA

Administrators can require multi-factor authentication for every member of the account, not just the people who'd opt in on their own. Once enforced, a member who hasn't set up MFA is prompted to before they can do anything else.

The factor is a **TOTP authenticator app, with one-time backup codes** for recovery.

<Note>
  This is distinct from **personal MFA**, which any individual can turn on for their own login today,
  on any plan. Enforcement — making it mandatory account-wide — is the Enterprise piece. See
  [Security](/admin/security).
</Note>

## Getting set up

<Steps>
  <Step title="Confirm your plan">
    SSO, SCIM and enforced MFA are Enterprise-only. Talk to your account team if you're not there
    yet.
  </Step>

  <Step title="Open the Admin Portal">
    Your account team provisions access.
  </Step>

  <Step title="Connect your identity provider">
    SAML metadata, or an OIDC client ID and secret — whichever your IdP uses.
  </Step>

  <Step title="Pilot with a small group before rolling out">
    Confirm attribute mapping and role assignment behave the way you expect before every member is
    routed through SSO.
  </Step>

  <Step title="Turn on SCIM and enforced MFA">
    Independently of each other, and independently of SSO itself — you can run SSO alone if that's
    all you need.
  </Step>
</Steps>

## Next

<CardGroup cols={2}>
  <Card title="Security" icon="shield" href="/admin/security">
    Encryption, subprocessors, and where compliance certifications actually stand.
  </Card>

  <Card title="Users and roles" icon="user-plus" href="/admin/users">
    How access works when it's managed by hand instead of SCIM.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.