Skip to main content
Single sign-on (SSO) lets your team authenticate using your existing identity provider (IdP) rather than managing a separate LumiID password. Once configured, you can enforce SSO workspace-wide so that all members log in through your IdP. SSO is available on Business and Enterprise plans.

​
Supported providers

LumiID supports any SAML 2.0-compatible identity provider, including most enterprise IdPs. Check your provider’s documentation for instructions on creating a SAML application.

​
Setting up SSO

1

Create an application in your IdP

In your identity provider’s admin console, create a new SAML application. You’ll need the following two values from your LumiID settings — both are available under Settings → Security → SSO:
  • ACS URL (also called the Reply URL or Callback URL)
  • Entity ID (also called the Audience URI)
2

Copy your IdP metadata

From your identity provider, copy the Metadata URL or download the Metadata XML file. You’ll use this in the next step.
3

Configure SSO in your workspace

Go to Settings → Security → SSO, paste your Metadata URL (or upload the XML file), and click Save.
4

Test the connection

Click Test SSO to verify your configuration before rolling it out to your whole team. A test login window will open — complete the login and you’ll see a success or error message.
5

Enable SSO

Once the test passes, toggle Enforce SSO to on. All workspace members will now be required to log in via your IdP.
Make sure you can successfully log in via SSO before enabling enforcement. If SSO breaks after enforcement is turned on, contact support — they can disable it for you.

​
SCIM provisioning

With SCIM provisioning enabled, users are automatically added to or removed from your LumiID workspace whenever you add or remove them in your IdP. This removes the need to manage membership in two places. SCIM setup is available under Settings → Security → SCIM.