Single sign-on for your team

Let your team sign in with your company's identity provider over SAML or OIDC, keep members in sync with your directory, and require SSO.

Embed
Preview of the card
<a href="https://referalli.com/guides/single-sign-on"><img src="https://referalli.com/guides/_api/public/orgs/07f432f4-34b9-46a7-aaad-c0e395d2e4f9/spaces/2d18b3a7-6f85-4e83-b889-e1a361196ad4/pages/9c0d724a-0190-4724-93d6-79bded6c382a/social-card.svg?v=3e7ae33eec8b" alt="Single sign-on for your team" width="600" height="315"></a>

With single sign-on (SSO), your team signs in to Referalli with your company's identity provider: Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud or any other that speaks SAML or OIDC. An SSO provider runs the connection and the directory sync (SCIM); on Referalli today that is Atlas. Referalli follows it: people join with the right role the first time they sign in, and lose access as soon as your directory removes them.

You set it up on Settings → Single sign-on (SSO). Only an owner can turn it on; owners and admins can send setup links.

  1. Link your organization

    Click Set up SSO. This creates your organization's directory at the SSO provider (an organization on Atlas today), with you as its first admin. You need to be signed in with the email-and-password or passkey account you use for Referalli (not "Sign in with Atlas").

  2. Send a setup link to your IT admin

    Choose how long the link stays valid (1 to 30 days) and click Create setup link. Copy the link and send it to whoever manages your identity provider. It's shown only once.

    On the setup page your IT admin, without needing a Referalli account:

    • connects your identity provider over SAML or OIDC (for SAML, the page shows the entity ID and ACS URL to enter in the identity provider);

    • verifies your email domain, such as acme.com, by adding a DNS record;

    • optionally turns on SCIM, so your directory adds and removes people automatically.

    You can revoke a link that hasn't been used yet. When the connection is active it appears under Connections with its domains.

  3. Map roles

    Your identity provider gives each person a role at the SSO provider. Role mapping decides which Referalli role that becomes. Role names come from the provider; with Atlas, by default, org:admin becomes Admin and org:member becomes Analyst. Add rows for any custom roles your directory uses, for example finance-team → Finance.

    Nobody becomes an Owner through SSO unless you map a role to Owner yourself, and an existing owner is never demoted by the directory.

  4. Require SSO (optional)

    Turn on Require SSO for members on our domains to make everyone whose email is on your SSO domains sign in through SSO. Teammates on other domains, such as contractors, keep signing in as before.

    Turn it on from an SSO session (sign out, then sign in again with your work email) so you don't lock yourself out. Referalli refuses to turn it on otherwise.

How membership stays in sync

In your directory

In Referalli

Someone signs in with SSO for the first time

They join your organization with their mapped role.

Their role changes

Their Referalli role changes to match (owners excepted).

They're removed, or their account is deleted

They're removed from your organization and signed out.

Their account is suspended

Their access is paused until it's restored.

The last owner is removed

Their access is suspended instead, so your organization always keeps an owner, and you get a notification. Add another owner on the Team page.

Signing in

Teammates sign in from the normal Referalli sign-in page with their work email. The SSO provider recognizes your domain and sends them to your identity provider. If SSO is required and someone signs in another way, Referalli sends them back to sign in with SSO.

Partners don't use your SSO: it's for your own team only.

Updated