Set up single sign-on

1. Prove you own your domain under Settings, Domains.
2. Open Settings, Security and choose SAML or OpenID Connect. Paste your provider's metadata, or fill the fields in yourself.
3. Give your provider what the page lists under What your identity provider needs.
4. Try it, then choose Require single sign-on if you want it for everyone.

Requiring it stops password, Google and Apple sign-in for everyone in the workspace, admins included. Keep the workspace owner exempt, so someone can still get in if the provider breaks.

Provisioning with SCIM, on the same page, lets your provider add people on your verified domains and take them out when they leave. Setup guides for your provider are at papertotal.com/security/single-sign-on.