# Verify your domain and connect your identity provider > How single sign-on works for a workspace on Plane Cloud, from verifying your email domain and connecting a SAML or OIDC provider to what people see when they sign in. Lesson 11 of 12 in Plane Business · 4:11 · [Watch the lesson](https://academy.plane.so/videos/sso-for-your-workspace) ## Chapters - [0:00](https://academy.plane.so/videos/sso-for-your-workspace?t=0) Sign in the company way - [0:35](https://academy.plane.so/videos/sso-for-your-workspace?t=35) Verify your email domain - [1:36](https://academy.plane.so/videos/sso-for-your-workspace?t=96) Connect your identity provider - [2:43](https://academy.plane.so/videos/sso-for-your-workspace?t=163) Sign in through your provider - [3:48](https://academy.plane.so/videos/sso-for-your-workspace?t=228) See the domain and provider in place ## Sign in the company way Single sign-on lets people sign in to your Plane workspace with their work account. Your company's identity provider confirms who they are, over SAML or OIDC. It's for companies that already manage people's accounts in one place. Plane uses those accounts instead of asking for another password. ## Verify your email domain On Business and higher, workspace admins set up single sign-on in **Workspace settings**, under **Identity**. The email domain comes first. Plane uses the domain in each email address to find your provider, and only one workspace can verify each domain. 1. Choose **Add domain**, type your company's domain, and choose **Add domain** again. 2. Plane shows a TXT record value. In your domain host's DNS settings, create a TXT record on the domain itself and paste the complete value. 3. Choose **Verify domain**. Once Plane finds the record, the status reads **Verified**. DNS changes can take up to 72 hours. If you choose **I'll do it later**, the domain stays **Pending** until you choose **Verify** in its menu. You can configure a provider only once the domain is verified. ## Connect your identity provider 1. Under **Single sign-on**, choose **Configure** beside **Enable SAML** or **Enable OIDC**, whichever your provider uses. 2. Start with **Get setup details**. It lists the URLs to copy into your identity provider when you register Plane there. 3. Paste your provider's own details back into Plane. For SAML, that's its **Entity ID**, **SSO URL**, and **Certificate**. **Logout URL** is optional. For OIDC, it's the **Client ID** and **Client secret**, plus the provider's **Authorize URL**, **Token URL**, and **Users' info URL**. 4. Choose **Configure and enable** to save the provider and switch it on, or **Configure only** to save it switched off. A workspace signs people in through one provider at a time. There's no test step, so try a sign-in yourself before you tell your team. ## Sign in through your provider 1. On the sign-in page, people choose **Sign in with Single Sign-On**, enter their work email, and choose **Continue**. 2. Plane finds the workspace that verified the email's domain and sends them to your identity provider. Once the provider confirms them, they're signed in. Someone signing in for the first time gets a Plane account, but they still need an invite to join your workspace. People with an email address outside your verified domains never reach your provider, so they keep signing in the way they do now. Single sign-on doesn't replace other sign-in methods: passwords and other accounts keep working, and no setting makes it the only way in. To change a provider, choose **Edit**, then **Save changes**. To stop using it, switch it off and choose **Configure only**. Removing someone from your identity provider doesn't remove them from the workspace, so remove them in **Members** too. Syncing groups from your provider is part of Enterprise Grid. ## See the domain and provider in place You've verified your domain and connected your identity provider, so your team can sign in to Plane with their work account. ## Try it Open Workspace settings, then Identity, choose Add domain, and type your company's email domain. ## Plans - Business: Single sign-on for the workspace, on Plane Cloud ## Docs - [Single sign-on](https://docs.plane.so/authentication/sso) ## Transcript ### Sign in the company way Single sign-on lets people sign in to your Plane workspace with their work account. Your company's identity provider confirms who they are, over SAML or OIDC. It's for companies that already manage people's accounts in one place. Plane uses those accounts instead of asking for another password. You'll verify your company's email domain, connect your identity provider, try a sign-in, and see what changes for members. Let's take a closer look. ### Verify your email domain On Business and higher, workspace admins set up single sign-on in Workspace settings, under Identity. The email domain comes first. Plane uses the domain in each email address to find your provider, and only one workspace can verify each domain. Choose Add domain, type your company's domain, and choose Add domain again. Plane then shows a TXT record value. In your domain host's DNS settings, create a TXT record on the domain itself and paste the complete value. DNS changes can take up to 72 hours. If you choose I'll do it later, the domain stays Pending until you choose Verify in its menu. Choose Verify domain, and once Plane finds the record, the status reads Verified. Only then can you configure a provider. ### Connect your identity provider With the domain verified, connect your identity provider. Under Single sign-on, choose Configure beside Enable SAML or Enable OIDC, whichever your provider uses. Start with Get setup details. It lists the URLs to copy into your identity provider when you register Plane there. Your provider then gives you its own details to paste back. For SAML, that's its Entity ID, SSO URL, and Certificate. Logout URL is optional. For OIDC, it's the Client ID and Client secret, plus the provider's Authorize URL, Token URL, and Users' info URL. Choose Configure and enable to save the provider and switch it on, or Configure only to save it switched off. A workspace signs people in through one provider at a time. There's no test step, so try a sign-in yourself before you tell your team. ### Sign in through your provider On the sign-in page, people choose Sign in with Single Sign-On, enter their work email, and choose Continue. Plane finds the workspace that verified the email's domain and sends them to your identity provider. Once the provider confirms them, they're signed in. Someone signing in for the first time gets a Plane account, but they still need an invite to join your workspace. People with an email address outside your verified domains never reach your provider, so they keep signing in the way they do now. Single sign-on doesn't replace other sign-in methods. Passwords and other accounts keep working, and no setting makes it the only way in. To change a provider, choose Edit, then Save changes. To stop using it, switch it off and choose Configure only. Removing someone from your identity provider doesn't remove them from the workspace, so remove them in Members too. Syncing groups from your provider is part of Enterprise Grid. ### See the domain and provider in place You've verified your domain and connected your identity provider, so your team can sign in to Plane with their work account.