Workspace sign-in and SSO

Open Workspace > Authentication. This tab requires workspace admin or owner access and the required Platform and Enterprise SSO licenses. If the tab is absent, ask an owner to check your access and the workspace licenses.

Add or edit a providerCopy Anchor Link

Work with the person who manages your organization's identity provider.

1. Under SSO providers, select Add provider. To change an existing provider, select its Edit button.
2. Choose Provider type and Status, enter a Provider key and Display name, then choose the Sync mode and Domain policy that match your organization's sign-in policy. The provider key names the Sorena connection; use the form's guidance rather than an identity-provider application ID. When restricting domains explicitly, enter one allowed domain per line.
3. Complete the configuration for your selected protocol. SAML accepts Federation Metadata XML or a Federation metadata URL. OIDC uses fields such as OIDC discovery URL, Issuer, Client ID, and Client secret.
4. Follow the setup guidance in the dialog to enter Sorena's setup values in your identity provider, then enter the provider's configuration back in Sorena.
5. Save the provider and review its displayed status. Saving configuration alone does not prove that a user can sign in; verify sign-in with the configured provider before changing the available sign-in methods.

Use View setup values on a provider to copy the current values needed by your identity provider. If setup values show Needs refresh, use the retry control in that section. Existing secret values are not displayed; follow the field instructions when updating a stored secret.

The protocol and provider key cannot be changed after a provider is saved. Keep manual mapping until you are ready to configure provisioning. SCIM push and directory-pull modes expose their respective provisioning-token fields; complete those only for the sync mode you intend to use. Leave a stored secret field blank when its hint says this keeps the current value.

Manage magic-link sign-inCopy Anchor Link

The Magic link card shows whether passwordless email sign-in is enabled. Disable magic link requires SSO to be enabled with at least one active provider. The confirmation explains that users will need an active SSO provider to sign in. Check working SSO access before confirming. Enable magic link makes that sign-in method available again.

Review provisioned usersCopy Anchor Link

Select SCIM users on a provider to inspect its provisioning view. Use Refresh after an identity-provider change. This view is read-only; make user lifecycle changes in the identity provider. An empty list means no SCIM users have been provisioned by that provider yet.

Delete a providerCopy Anchor Link

Select Delete on the provider, check its name, then confirm Delete provider. Users can no longer sign in through that provider. Review the remaining active providers and magic-link availability before deleting it.

If providers fail to load, select Retry. For sign-in recovery, use sign-in help or contact support.