---
title: "Single sign-on and SCIM"
description: "Let team members sign in through your identity provider with SAML or OpenID Connect, require SSO, keep break-glass owners, and provision members with SCIM."
url: "https://cookiebeam.com/docs/account/sso-and-scim"
lang: "en"
---

# Single sign-on and SCIM

Let team members sign in through your identity provider with SAML or OpenID Connect, require SSO, keep break-glass owners, and provision members with SCIM.

Enterprise SSO and SCIM directory sync are part of the **Enterprise** plan. On other plans the **SSO** page shows an upgrade notice instead of the settings, and the server refuses SSO and SCIM changes.

Only the team owner can change SSO and SCIM settings. Open **SSO** in the dashboard sidebar.

## 1. Verify your email domains

SSO and SCIM can only sign in or create members whose email address is on a domain you have verified.

1. Under **Verified Domains**, enter your domain, for example `example.com`.
2. Add the TXT record shown to your DNS.
3. Select **Check DNS**. The status changes from **Pending** to **Verified** once the record is found.

Repeat this for each email domain your staff use.

## 2. Connect your identity provider

CookieBeam supports SAML 2.0 and OpenID Connect (OIDC).

For **SAML**:

1. Enter a connection name.
2. Enter your identity provider's metadata URL, or paste its metadata XML.
3. Save. CookieBeam then shows the **Callback / ACS URL** and the **SP-initiated sign-in URL**.
4. Add the ACS URL to the application in your identity provider.

For **OIDC**:

1. Enter a connection name.
2. Enter the OpenID Connect discovery URL, the client ID and the client secret.
3. Save, then copy the **Redirect URI** into your identity provider.

Turn on the connection's **Enable SSO** switch to let members sign in through the connection. **Allow IdP-initiated sign-in** lets people start from your identity provider's dashboard. Leave it off unless your provider needs it, because sign-in started from CookieBeam is the safer flow.

## What happens when someone signs in

- **An invited person** joins with the permissions in their invitation.
- **An existing member** signs in as usual.
- **A new person from a verified domain, with no invitation,** is added as an **Editor** with no banner access. An owner or admin then gives them access to banners.
- **An existing CookieBeam user who is not a member of your team** is refused until someone invites them.

New members created by SSO count toward your plan's member limit. When the team is full, sign-in for new people is refused.

## Require SSO

Turn on **Require SSO** to make members sign in through your identity provider. An enabled SSO connection is needed first.

While SSO is required, password sign-in is blocked for everyone except **break-glass owners**:

- Break-glass owners are owners who can still sign in with a password and two-factor authentication, so an identity-provider outage cannot lock the team out.
- Only owners with two-factor authentication enabled can be designated.
- Every break-glass sign-in is logged and emailed to all owners.

Designate at least one break-glass owner before you require SSO. If none is designated and your identity provider fails, nobody on the team can sign in.

## SCIM directory sync

SCIM lets your identity provider add and remove team members automatically.

1. Under **SCIM Directory Sync**, enter a directory name and turn on **Enable SCIM**.
2. Save. CookieBeam shows the **SCIM endpoint** and a **Bearer token**.
3. Copy the token now. It is shown only once.
4. Enter the endpoint and token in your identity provider's SCIM settings.

When your identity provider deactivates or deletes a user, CookieBeam removes them from the team and revokes their access. If that was their only team, their CookieBeam user is deactivated too. New users from a verified domain are added as Editors unless they have a pending invitation. The page shows the number of connected users and the time of the last sync.

To replace the token, select **Rotate**. The old token stops working immediately, so your identity provider stops syncing until you paste the new one.

## Related

- [Team members and roles](https://cookiebeam.com/docs/account/team-and-roles)
- [Two-factor authentication and sessions](https://cookiebeam.com/docs/account/security)