Set up SAML single sign-on for Slack

SAML-based single sign-on (SSO) gives members access to Slack through an identity provider (IDP) of your choice.

Note: If you’re having trouble setting up SAML SSO, visit Troubleshoot SAML authorisation errors for help.

Tip: Workspace owners and org owners can bypass SSO authentication to sign in with an email address and password. This guarantees access to Slack even if your IDP is having issues.

Step 1: Configure your identity provider

To get started, you’ll need to set up a connection between your IDP and Slack. Many of the providers that we work with have created content to guide you through enabling SAML for Slack:

• Auth0
• Google Workspace (SAML)
• JumpCloud
• LastPass

• Microsoft Entra
• Okta
• OneLogin
• PingFederate and PingOne

Note: We also offer guides to help you set up custom SAML SSO, Google Workspace SSO or ADFS SSO.

Step 2: Set up SAML SSO

Free, Pro and Business+ subscriptions

Enterprise subscriptions

Once you’ve configured your IDP, a workspace owner can enable SSO.

1. From your desktop, click   Admin in the sidebar. If you can’t see this option, click your workspace name to access workspace settings instead.
2. Select Workspace settings from the menu.
3. Click   Security, then select SSO & authentication. 
4. Next to An identity provider or custom SAML, click Configure SAML.
5. In the top right, toggle Test mode on.
6. Next to SAML SSO URL, enter your SAML 2.0 endpoint URL. (This came from setting up your connector earlier). If Okta is your IDP, you can optionally include the IDP URL instead.
7. Next to Identity provider issuer, enter your IDP entity ID. 
8. Copy the entire x.509 certificate from your identity provider and paste it into the Public certificate field.
9. Next to Advanced options, click Expand. Choose how the SAML response from your IDP is signed. If you need an end-to-end encryption key, tick the box next to Sign AuthnRequest to show the certificate.
10. Under Settings, choose whether members can edit their profile information (like their email or display name) after SSO is enabled. You can also choose whether SSO is required, partially required or optional.
11. Below Customise, enter a sign-in button label.
12. Click Save Configuration to finish.

Once you’ve configured your IDP, an org owner can enable SSO.

1. From your desktop, click your organisation name in the top left.
   
2. Select Tools & settings from the menu, then click Organisation settings.
3. From the sidebar, click   Security, then click SSO settings. 
4. Enter your SSO name.
5. Enter your SAML 2.0 endpoint URL (this came from setting up your connector earlier) to configure where authentication requests from Slack will be sent.
6. Enter your identity provider issuer URL. 
7. By default, the service provider issuer URL is set to https://slack.com. This field should match what you’ve set in your IDP.
8. Copy the entire x.509 Certificate from your IDP.
9. Choose whether the SAML responses and assertions are signed. If you require an end-to-end encryption key for your IDP, tick the box next to Sign AuthnRequest to show the certificate. You can also select your preference for AuthnContextClassRef values.
10. Click Test configuration. We'll let you know if the changes are successful or whether you need to make further changes.
11. Click Turn on SSO or Add SSO.

Set up additional SSO configurations

You can add up to 11 additional SSO configurations to allow people to log in to Slack from IDPs of your choice. 

1. From your desktop, click on your organisation name at the top left.
   
2. Hover over Tools & settings, then click Organisation settings. 
3. From the left sidebar, click  Security, then click SSO settings.
4. Click Add SSO Configuration in the top right. 

Tip: If you have guests in your workspace or organisation, we recommend choosing the option where SSO is partially required so that they can still sign in with their email address and password.

Note: After setting up SSO, you can manage SSO settings and learn how to connect IDP groups to workspaces in your organisation.

What to expect after SSO is enabled

Once you’ve set up SSO, members that are required to sign in with SSO will receive an email. The email will prompt members to bind their Slack accounts with your IDP. Members will have 72 hours to bind their account before their link expires.

Any members already signed in when SSO is enabled will remain signed in. Going forward, all members will sign in to Slack with their IDP account. If you chose to require SSO, your members will see a sign-in page before they can access Slack.

Note: To simplify member management, Slack supports the SCIM provisioning standard. 

Who can use this feature?

• Workspace owners and org owners
• Available on the Business+ and Enterprise subscriptions
• Available on the Free and Pro subscriptions if you’ve connected a Salesforce org to Slack