Skip to main content
An SSO connection hands authentication to your identity provider (Okta, Microsoft Entra ID, Google Workspace, ADFS, or another SAML or OIDC provider) and has a life beyond initial setup:
  1. Set up: after verifying your domain, you connect your IdP through a self-service wizard that exchanges SAML or OIDC details and maps user attributes. See Set up SSO.
  2. Maintain: SAML connections verify each login against your IdP’s signing certificate. When that certificate expires or your security team rotates it, you update ION with the new one, coordinated with the IdP switch. OIDC keys rotate automatically. See Rotate your SAML signing certificate.
  3. Retire: disabling SSO removes the connection and returns your team to email and password sign-in without deleting any accounts. See Disable SSO.
A misconfigured SSO connection or an out-of-sync certificate rotation blocks fresh sign-ins to production. Validate authentication changes in a sandbox tenant when you have one, and keep the previous certificate on hand during a rotation.