> ## Documentation Index
> Fetch the complete documentation index at: https://launchdarkly-preview.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> This topic explains what Single Sign-On (SSO) features are available in LaunchDarkly.

> For the complete documentation index, see [llms.txt](/llms.txt). For the full documentation snapshot, see [llms-full.txt](/llms-full.txt).

<Note title="Single sign-on is available to customers on select plans">
  Single sign-on is only available to customers on select plans. To learn more, [read about our pricing](https://launchdarkly.com/pricing/). To upgrade your plan, [contact Sales](https://launchdarkly.com/contact-sales/).
</Note>

## Overview

This topic explains what Single Sign-On (SSO) features are available in LaunchDarkly.

SSO allows your team to authenticate with LaunchDarkly using the same identity provider (IdP) you use for your other internal and external services. LaunchDarkly implements SSO with the SAML 2.0 protocol. You can use SSO with your IdP to manage access rights in LaunchDarkly. You can use SSO to manage both member login and member roles, or you can use SSO to manage member login only, and continue to manage member roles within LaunchDarkly.

As a customer on an Enterprise or Guardian plan, after you enable SSO, System for Cross-domain Identity Management (SCIM) becomes available. SCIM facilitates user provisioning, which means your IdP can use it to create, update, and deactivate members in LaunchDarkly. Administrators can optionally turn on and configure team sync with SCIM, which lets admins sync groups in their IdP with LaunchDarkly teams.

## Enable SSO in Launch

Darkly

To configure SSO in your LaunchDarkly account:

1. Enable SAML SSO in your account. Configure LaunchDarkly to use your IdP when account members request access. To learn how to do this, read [Configure SAML SSO](/home/account/saml).
2. (Enterprise and Guardian - Optional) Configure SCIM to enable the automation of user and group provisioning. To learn how to do this, read [Enable SCIM provisioning](/home/account/scim).

### Supported external identity providers

We provide support for the following IdPs:

<table class="fern-table">
  <tr>
    <th>
      Identity provider
    </th>

    <th>
      SAML SSO integration: member and team provisioning
    </th>

    <th>
      SCIM integration (Enterprise only)
    </th>

    <th>
      Team sync with SCIM (Enterprise only)
    </th>
  </tr>

  <tr>
    <td>
      ADFS
    </td>

    <td>
      <img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/b2a1fcd354840ee9c101cdddb552795ad968276d33c14a16639d568eae9ee019/assets/icons/checkbox-marked-circle.svg" height="1.5rem" />
    </td>

    <td />

    <td />
  </tr>

  <tr>
    <td>
      Entra ID
    </td>

    <td>
      <img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/b2a1fcd354840ee9c101cdddb552795ad968276d33c14a16639d568eae9ee019/assets/icons/checkbox-marked-circle.svg" height="1.5rem" />
    </td>

    <td />

    <td />
  </tr>

  <tr>
    <td>
      GitHub OAuth
    </td>

    <td />

    <td />

    <td />
  </tr>

  <tr>
    <td>
      Google Workspace
    </td>

    <td>
      <img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/b2a1fcd354840ee9c101cdddb552795ad968276d33c14a16639d568eae9ee019/assets/icons/checkbox-marked-circle.svg" height="1.5rem" />
    </td>

    <td />

    <td />
  </tr>

  <tr>
    <td>
      Google OAuth
    </td>

    <td />

    <td />

    <td />
  </tr>

  <tr>
    <td>
      Okta
    </td>

    <td>
      <img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/b2a1fcd354840ee9c101cdddb552795ad968276d33c14a16639d568eae9ee019/assets/icons/checkbox-marked-circle.svg" height="1.5rem" />
    </td>

    <td>
      <img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/b2a1fcd354840ee9c101cdddb552795ad968276d33c14a16639d568eae9ee019/assets/icons/checkbox-marked-circle.svg" height="1.5rem" />
    </td>

    <td>
      <img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/b2a1fcd354840ee9c101cdddb552795ad968276d33c14a16639d568eae9ee019/assets/icons/checkbox-marked-circle.svg" height="1.5rem" />
    </td>
  </tr>

  <tr>
    <td>
      OneLogin
    </td>

    <td>
      <img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/b2a1fcd354840ee9c101cdddb552795ad968276d33c14a16639d568eae9ee019/assets/icons/checkbox-marked-circle.svg" height="1.5rem" />
    </td>

    <td>
      <img src="https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/b2a1fcd354840ee9c101cdddb552795ad968276d33c14a16639d568eae9ee019/assets/icons/checkbox-marked-circle.svg" height="1.5rem" />
    </td>

    <td />
  </tr>
</table>

Some customers use the following identity providers. Although we do not offer support for these providers, we can share some configuration guidance based on what has been successful for other customers:

* [PingIdentity](/home/account/pingidentity)
* Centrify
* SecureAuth
* DuoMobile

You can only use one identity provider per LaunchDarkly account.

### Default initial role

During account member provisioning, LaunchDarkly sets the default initial role for new members to a role that you specify.

To set a default initial role:

1. Click the **gear** icon in the left sidenav to view Organization settings.
2. Click **Security**.
3. Under "SSO Management," click **Configure SAML**. The SAML configuration panel appears.
4. Under "Default initial role," select the default **Role** for new members.
5. Click **Save**.

<Frame caption="The &#x22;Default initial role&#x22; section of the SAML configuration panel.">
  ![The "Default initial role" section of the SAML configuration panel.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/6a73c0dea62d8c20f8020777d9ccec824a4d2cfe4e79e39de647892b988da3fe/assets/images/auto/default-initial-saml-role.auto.png)
</Frame>

LaunchDarkly sets the default initial role for new members to the initial **Role** specified here, unless you have specified a different role in your IdP.

We recommend setting the default initial role to No access. The No access base role can help you mitigate risk, for instance if you have private projects that should be hidden from most members.

<Note>
  Developer and Foundation customers can only set the default role to the Reader base role.
</Note>

To learn more about roles and their permissions, read [Roles](/home/account/roles). For an in-depth guide on how to use custom roles with IdPs, read [Creating roles](/guides/teams-roles/custom-roles).