Single sign-on is an Enterprise feature. Settings → Single sign-on appears for admins of enterprise workspaces.
Set up
Add your domain
Enter your company domain, such as acme.com, and click Add domain.
Prove you own it
Henry shows a DNS record: a host name and a value. Add it at your DNS provider, then click Verify domain. The status reads Awaiting DNS verification until the record is found.
Connect your identity provider
Create a SAML application in Okta, Entra ID, or your IdP. Paste its metadata URL or XML into Henry and click Connect IdP. The status becomes Active, optional: people at your domain can use SSO, and other sign-in methods still work.
Test a sign-in
Sign in through SSO with a test account before enforcing it.
Require SSO
Click Require SSO. The status becomes Active, SSO required. From now on, email and Google sign-in are blocked for that domain.
What existing users see
People who already had a Henry account with an email at your domain are asked to Move your account to SSO the next time they sign in. Their workspaces, memory, and settings come with them. Users who are already signed in stay signed in until they sign out.
Changing your IdP
Click Update metadata to paste new metadata. This turns Require SSO back off so you can test the new configuration. Test a sign-in, then click Require SSO again.
Turning it off
Stop requiring SSO lets other sign-in methods work again while keeping SSO available. Remove disconnects the domain entirely.
Multi-factor authentication
MFA is enforced by your identity provider when SSO is required. Users without SSO can enable an authenticator app themselves in Settings → Profile.
