> ## Documentation Index
> Fetch the complete documentation index at: https://jam.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO

> Connect your identity provider for single sign-on and automatic workspace management. Access stays centralized and manual work stays low.

<Info>
  SSO and Directory Sync are available on the [**Enterprise**](https://jam.dev/pricing) plan only. [Contact sales](https://jam.dev/contact-sales) to upgrade.
</Info>

<img src="https://mintcdn.com/jam-1eb4fd26/3Mtv5mLh0Dqadb4R/images/sso-providers-list.png?fit=max&auto=format&n=3Mtv5mLh0Dqadb4R&q=85&s=38e76664eaf3b9ae57a46414af855fdb" alt="Single Sign-On settings showing GoogleSAML for @acme.com and Google Workspace with 21 synced members" width="1803" height="951" data-path="images/sso-providers-list.png" />

## How it works

**SSO (Single Sign-On)** connects your identity provider to Jam for authentication. Team members log in using their existing corporate credentials instead of a separate Jam password.

**Directory Sync** automatically reflects user changes from your IdP in Jam. Changes to your IdP sync automatically to your Jam workspace with no manual work.

## Supported identity providers

* Okta
* Azure AD
* Google Workspace
* Any SAML-compatible provider

## Configure

<Tabs>
  <Tab title="SSO setup">
    Configure Single Sign-On

    <Steps>
      <Step title="Open Settings">
        Go to [**Settings**](https://jam.dev/s/settings).
      </Step>

      <Step title="Start the SSO setup">
        In the **Access** section, click **Setup** next to **Identity Provider**.
      </Step>

      <Step title="Follow the guided walkthrough">
        Follow the setup walkthrough for your identity provider.
      </Step>

      <Step title="Finish configuration in your IdP">
        Complete the required configuration steps on your identity provider's side.
      </Step>
    </Steps>

    You should now see your IdP listed in the Access section. Members can now log in with SSO.

    <Info>
      SSO is configured for a single domain by default. Need multiple domains? [Contact](https://jam.dev/help) our team to enable additional domains.
    </Info>
  </Tab>

  <Tab title="Directory Sync setup">
    Configure Directory Sync to automate user provisioning and removal.

    <Steps>
      <Step title="Open Settings">
        Go to [**Settings**](https://jam.dev/s/settings).
      </Step>

      <Step title="Start the Directory Sync setup">
        In the **Access** section, click **Setup** next to **Active Directory**.
      </Step>

      <Step title="Follow the guided walkthrough">
        Complete the step-by-step configuration walkthrough for your IdP.
      </Step>

      <Step title="Select user groups to sync (optional)">
        Choose which user groups from your IdP should sync to Jam. This step is optional.
      </Step>
    </Steps>

    You should now see your IdP listed in the Access section. New users added to your IdP automatically join your workspace.

    <Info>
      Provisioned users get the Creator role by default. You'll need to adjust roles manually in [**Settings → Members**](https://jam.dev/s/settings/members).
    </Info>
  </Tab>
</Tabs>

## User management

How you manage team members depends on whether Directory Sync is enabled.

<Tabs>
  <Tab title="With Directory Sync">
    <img src="https://mintcdn.com/jam-1eb4fd26/3Mtv5mLh0Dqadb4R/images/members-list-directory-sync.png?fit=max&auto=format&n=3Mtv5mLh0Dqadb4R&q=85&s=8c3947e5d6821df13ec85b4e9ccf79a9" alt="Members list with the Active Directory sync enabled banner and 21 synced members" width="1803" height="951" data-path="images/members-list-directory-sync.png" />

    **Automated Management**

    * User provisioning: Happens in your identity provider
    * New user notifications: Users get email notifications when provisioned
    * Role management: Handle manually in [**Settings → Members**](https://jam.dev/s/settings/members)
    * User removal: Remove from IdP to revoke Jam access automatically
    * Group sync: Manage access via user groups in your IdP

    Access directory sync management in [**Settings → Members**](https://jam.dev/s/settings/members).

    <Info>
      User groups cannot be mapped to specific Jam roles automatically. Role assignment requires manual configuration.
    </Info>
  </Tab>

  <Tab title="Without Directory Sync">
    <img src="https://mintcdn.com/jam-1eb4fd26/3Mtv5mLh0Dqadb4R/images/members-list-manual.png?fit=max&auto=format&n=3Mtv5mLh0Dqadb4R&q=85&s=6fc5dc600998be33a0d3e54924c78467" alt="Members list with the Add members button and three members, with no Directory Sync banner" width="1536" height="810" data-path="images/members-list-manual.png" />

    **Manual Management**

    * User provisioning: Add users directly in [**Settings → Members**](https://jam.dev/s/settings/members)
    * Role management: Assign and modify roles in Jam
    * User removal: Remove users manually in [**Settings → Members**](https://jam.dev/s/settings/members)

    All user management happens in [**Settings → Members**](https://jam.dev/s/settings/members).

    <Warning>
      User groups cannot be mapped to specific Jam roles automatically. Role assignment requires manual configuration.
    </Warning>
  </Tab>
</Tabs>

## FAQ

<AccordionGroup>
  <Accordion title="Can I use SSO without Directory Sync?">
    Yes. SSO handles authentication while Directory Sync manages user provisioning. You can enable either feature independently.
  </Accordion>

  <Accordion title="What identity providers are supported?">
    Jam supports all major identity providers, including Okta, Azure AD, Google Workspace, and any SAML-compatible provider.
  </Accordion>

  <Accordion title="Can I map user groups to specific Jam roles?">
    Not automatically. While you can sync user groups from your IdP, role assignment requires manual configuration in [**Settings → Members**](https://jam.dev/s/settings/members).
  </Accordion>

  <Accordion title="What happens when I remove a user from my identity provider?">
    With Directory Sync enabled, the user automatically loses access to Jam when they are removed from your IdP.
  </Accordion>
</AccordionGroup>