Skip to main content
Sprig supports Single Sign-On (SSO) via SAML 2.0. This allows you to integrate with most SAML-compliant Identity Providers (IdPs).
Note: SAML SSO is available for customers on Sprig Enterprise plans.
To deprovision existing Sprig users from your identity provider, see SCIM. SCIM is an enterprise feature. Use the links below to find configuration guides for popular IdPs:

​
Require SSO

After SSO is set up, you can require members to sign in through your identity provider instead of with a Sprig password or Sign in with Google.
  1. Go to Settings > Single Sign-On.
  2. In the Enable SSO section, confirm SSO Enabled is selected.
  3. Under Enforce SSO, choose one option:
    • Enforce SSO for All Non-Admin Users: everyone except Organization Admins must sign in with SSO. Organization Admins can still sign in with a password or Sign in with Google, which keeps a way in if your identity provider is unavailable.
    • Enforce SSO for All Users: everyone, including Organization Admins, must sign in with SSO.
  4. Click Save.
When SSO is enforced for a member, Sprig blocks password sign-in, Sign in with Google, and password resets for that member. Workspace Admins are not exempt from Enforce SSO for All Non-Admin Users.
Before you enforce SSO for all users, confirm at least one Organization Admin can sign in through your identity provider. Members who can’t sign in with SSO will be locked out until SSO works for them.

​
Roles from your identity provider

When a member signs in with SSO, Sprig sets their role from the role attribute your identity provider sends. This happens on every SSO sign-in, not only the first one, so a role change made in Sprig is replaced the next time the member signs in. Manage roles for SSO members in your identity provider. The role attribute accepts admin (Organization Admin), developer, editor, editor-lite, and viewer. See Roles & Permissions for what each role can do.