Skip to main content
ION identifies every user by their company email address. When someone signs in, ION looks at the email’s domain to decide what happens next: if the domain has an SSO connection, ION redirects to your identity provider to authenticate; otherwise the user enters an ION password. Everything you configure on the Settings > Organization > Authentication page shapes that flow: which domains belong to your organization, whether SSO is on, whether MFA is required, and what the sign-in page looks like.

​
Two ways to sign in

  • Email and password: ION manages the credential. New users get an invite email with a link to set their password, and a forgotten password is reset from the sign-in page.
  • Single sign-on (SSO): your identity provider manages the credential. ION creates a user profile automatically on first SSO sign-in with the default User role, and removing someone from your IdP stops their SSO access to ION. Passwords, in this case, are reset in your IdP, not in ION. For connecting and maintaining an IdP, see the SSO overview.
The two coexist per domain, not per user: once SSO is active for a verified domain, users on that domain are routed to the IdP.

​
Domains

A claimed, verified domain tells ION that email addresses on that domain belong to your organization. Verification works by DNS: ION gives you a TXT record to publish, then confirms you own the domain. A verified domain acts as an allowlist that associates matching users with your organization at sign-up, and it’s the prerequisite for SSO. See Manage domains.