> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://buildwithfern.com/learn/llms.txt.

# Set up Single Sign-On (SSO)

> Let teammates sign in to Fern with your IdP (SAML or OIDC)

#### Enterprise feature

This feature is available only for the [Enterprise plan](https://buildwithfern.com/pricing). To get started, reach out to [support@buildwithfern.com](mailto:support@buildwithfern.com).

Set up Single Sign-On (SSO) to sign in to Fern using your existing identity provider.

SSO setup requires working with Fern to exchange configuration values (like callback URLs and entity IDs). To get started, select your identity provider below (Okta, Google Workspace, or Microsoft Entra), then choose SAML or OIDC.

#### Using another provider?

If you use another IdP, Fern will help you configure it. Reach out via Slack or [support@buildwithfern.com](mailto:support@buildwithfern.com) to get started.

#### Okta

#### SAML

#### Receive configuration values from Fern

Fern will send you the SSO URL and Audience URI through a secure channel.

#### Create and configure application in Okta

In **Applications**, create a new app integration using **SAML 2.0**. Configure with these values:

| Field              | Value              |
| ------------------ | ------------------ |
| Single sign-on URL | \[value from Fern] |
| Audience URI       | \[value from Fern] |
| Name ID format     | `EmailAddress`     |

Then, add attribute statements:

| Name    | Value                                  |
| ------- | -------------------------------------- |
| `name`  | `user.firstName + " " + user.lastName` |
| `email` | `user.email`                           |

#### Send Fern your IdP metadata

From the **Sign-On** tab, copy the Metadata URL and X.509 certificate. Send them back to Fern. Fern will enable the connection and run a test login with you.

#### Disable IdP-initiated login

In the **General** tab under **App visibility**, enable **Do not display application icon to users**. This prevents IdP-initiated login flows, which carry security risks.

#### Assign users

Assign the people who should access Fern.

#### OIDC

#### Receive configuration values from Fern

Fern will send you the Redirect URI through a secure channel.

#### Create and configure application in Okta

In **Applications**, create a new **Web Application** using OIDC. Use Authorization Code grant and set the Redirect URI to the value Fern provided.

#### Send Fern your IdP credentials

Share the Client ID, Client Secret, and your Okta domain (e.g., `<your-tenant>.okta.com`) back to Fern. Fern will enable the connection and run a test login with you.

#### Disable IdP-initiated login

In the **General** tab under **App visibility**, enable **Do not display application icon to users**. This prevents IdP-initiated login flows, which carry security risks.

#### Assign users

Assign the people who should access Fern.

#### Google Workspace

#### SAML

#### Receive configuration values from Fern

Fern will send you the ACS URL and Entity ID through a secure channel.

#### Create and configure application in Google

In **Web and mobile apps**, choose **Add app → Add custom SAML app**. On **Service provider details**, enter these values:

| Field          | Value              |
| -------------- | ------------------ |
| ACS URL        | \[value from Fern] |
| Entity ID      | \[value from Fern] |
| Name ID format | `EMAIL`            |
| Name ID        | `Primary email`    |

Then, add attribute statements:

| Google Directory Attribute | App Attribute |
| -------------------------- | ------------- |
| `First name`               | `firstName`   |
| `Last name`                | `lastName`    |

#### Send Fern your IdP metadata

Copy the SSO URL, Entity ID, and X.509 certificate from Google. Send them to Fern. Fern will enable the connection and run a test login with you.

#### Assign users

Assign the people who should access Fern.

#### Microsoft Entra

#### SAML

#### Create an application

Under **Enterprise applications**, select **New application → Create your own application → Non-gallery**.

#### Receive configuration values from Fern

Fern will send you the Identifier (Entity ID) and Reply URL (ACS) through a secure channel.

#### Configure SAML

In **Single Sign-On**, choose **SAML** and enter these values:

| Field                  | Value                                    |
| ---------------------- | ---------------------------------------- |
| Identifier (Entity ID) | \[value from Fern]                       |
| Reply URL (ACS)        | \[value from Fern]                       |
| Name ID                | `user.primaryauthoritativeemail` (email) |

Then, add attribute statements:

| Name    | Value              |
| ------- | ------------------ |
| `name`  | `user.displayname` |
| `email` | `user.mail`        |

#### Send Fern your IdP metadata

From **SAML Certificates**, copy the **App Federation Metadata URL**. Send it to Fern. Fern will enable the connection and run a test login with you.

#### Disable IdP-initiated login

To prevent IdP-initiated login flows (which carry security risks), do not distribute the User access URL.

Optionally, create a Conditional Access policy to block sign-ins that don't originate from your service provider.

#### Assign users

In **Users and groups**, add the people who should access Fern.

> Let teammates sign in to Fern with your IdP (SAML or OIDC)