> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehenry.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Connect Okta, Microsoft Entra ID, or any SAML 2.0 identity provider, and require it for your domain.

<Note>
  Single sign-on is an Enterprise feature. **Settings → Single sign-on** appears for admins of enterprise workspaces.
</Note>

Once a domain is connected, everyone with an email at that domain signs in through your identity provider. New users are provisioned on first sign-in.

## Set up

<Steps>
  <Step title="Add your domain">
    Enter your company domain, such as `acme.com`, and click **Add domain**.
  </Step>

  <Step title="Prove you own it">
    Henry shows a DNS record: a **host name** and a **value**. Add it at your DNS provider, then click **Verify domain**. The status reads **Awaiting DNS verification** until the record is found.
  </Step>

  <Step title="Connect your identity provider">
    Create a SAML application in Okta, Entra ID, or your IdP. Paste its metadata URL or XML into Henry and click **Connect IdP**. The status becomes **Active, optional**: people at your domain can use SSO, and other sign-in methods still work.
  </Step>

  <Step title="Test a sign-in">
    Sign in through SSO with a test account before enforcing it.
  </Step>

  <Step title="Require SSO">
    Click **Require SSO**. The status becomes **Active, SSO required**. From now on, email and Google sign-in are blocked for that domain.
  </Step>
</Steps>

## What existing users see

People who already had a Henry account with an email at your domain are asked to **Move your account to SSO** the next time they sign in. Their workspaces, memory, and settings come with them. Users who are already signed in stay signed in until they sign out.

## Changing your IdP

Click **Update metadata** to paste new metadata. This turns **Require SSO** back off so you can test the new configuration. Test a sign-in, then click **Require SSO** again.

## Turning it off

**Stop requiring SSO** lets other sign-in methods work again while keeping SSO available. **Remove** disconnects the domain entirely.

## Multi-factor authentication

MFA is enforced by your identity provider when SSO is required. Users without SSO can enable an authenticator app themselves in **Settings → Profile**.