> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO FAQ

> Frequently asked questions about Single Sign-On (SSO) setup, domains, organizations, and user provisioning

<AccordionGroup>
  <Accordion title="We have multiple Profound organizations. How do we set up SSO?">
    SSO is configured per organization. Each organization needs its own SSO connection, which means its own verified domain and its own Profound application in your IdP. Users who belong to several organizations typically see one Profound tile per organization in their IdP, and sign in to each organization through its own connection.

    You can use the same domain for the SSO connections of several organizations. Before you set up SSO for a second organization on a domain that's already verified for another one, contact [customer support](mailto:support@tryprofound.com): Profound needs to adjust settings on its side first. You can also use different protocols for each connection, even with the same identity provider.

    <img src="https://mintcdn.com/profound-37face47/0oMqQAjfTDxpRjFF/images/enterprise-connections/sso-multiple-organizations.webp?fit=max&auto=format&n=0oMqQAjfTDxpRjFF&q=85&s=45dd57597fb68fd02c8413a34c0e479c" alt="Diagram showing that each Profound organization has its own SSO connection: identity provider A connects to organization 1 over OIDC and to organization 2 over SAML, while identity providers B and C each connect to a further organization" width="2000" height="1481" data-path="images/enterprise-connections/sso-multiple-organizations.webp" />

    To set up each organization's SSO connection, follow the steps in [Configure SSO](/platform-config/authentication/configure-sso) or, if you're using a custom authorization server, see [Configure SSO with a custom OIDC connection](/platform-config/authentication/sso-custom-oidc).

    To add people to the correct organization through the correct SSO connection, invite them from the [People page](/platform-config/people/add-and-manage-team-members) in that organization's settings.
  </Accordion>

  <Accordion title="Where do I get the service provider details, such as the Entity ID, ACS URL, metadata, or redirect URI?">
    The SSO configuration portal generates them for your organization. Profound doesn't publish fixed connection values, and you don't need to request them from support.

    To get them, open **Settings** > **Organization** > **Enterprise Setup** and select **Configure SSO**. After you verify your domain and select your identity provider (IdP), the portal shows the values to copy into your IdP:

    * **Security Assertion Markup Language (SAML)**: the ACS URL, Service Provider Entity ID, and Metadata URL
    * **OpenID Connect (OIDC)**: the Authorized Redirect URI

    The values are generated per SSO connection and don't appear anywhere else in Profound. See [Step 4 of Configure SSO](/platform-config/authentication/configure-sso#step-4).
  </Accordion>

  <Accordion title="Why am I asked to add a DNS TXT record?">
    Domain verification and IdP configuration are separate steps. The DNS TXT record proves that your organization owns the email domain your users sign in with. You connect your IdP in the next step, after the domain is verified.

    The DNS instructions in the portal name the provider that hosts your domain's DNS records, such as Cloudflare or AWS Route 53. That provider isn't your IdP, and seeing it there doesn't mean your IdP selection is wrong. See [Domain verification for SSO](/platform-config/authentication/sso-domain-verification).
  </Accordion>

  <Accordion title="Can I verify a subdomain or a separate domain instead of the root domain?">
    Verify whichever domain appears after the @ in your users' email addresses, whether that's a root domain or a subdomain. If your team signs in with `name@example.com`, verify `example.com`. If they sign in with `name@mail.example.com`, verify `mail.example.com`. A different domain, such as a separate challenge domain set up only for the verification, can't stand in for it.

    Verifying a root domain doesn't cover its subdomains, and verifying a subdomain doesn't cover the root domain, so verify each domain your users sign in with. Once verified, your SSO connection covers it like any other verified domain. See [Verify multiple domains](/platform-config/authentication/sso-domain-verification#verify-multiple-domains).
  </Accordion>

  <Accordion title="Can we attach multiple email domains to one SSO connection?">
    Yes. Domains are verified for your organization, and your organization's SSO connection covers every verified domain. Verify each domain your users sign in with, and Profound directs users on any of them to your IdP.

    To add a domain, open **Settings** > **Organization** > **Enterprise Setup** and select **Add domain** on the **Single Sign-On** card. The portal opens on the domain verification step. Each domain gets its own TXT record, so add every record to the domain it was issued for. See [Verify multiple domains](/platform-config/authentication/sso-domain-verification#verify-multiple-domains).
  </Accordion>

  <Accordion title="Once SSO is on, can users outside our IdP, such as agencies or contractors, still sign in with email and password?">
    It depends on their email domain.

    * Users whose email domain is one of your verified domains go straight to your IdP. Enabling SSO turns off password sign-in for them. To allow password sign-in alongside SSO for these users, for example during a rollout, contact [customer support](mailto:support@tryprofound.com).
    * Users on other domains, such as agency or contractor accounts, keep signing in with an email address and password.

    See [Sign-in when SSO is enabled](/platform-config/authentication/sign-in-security#sign-in-when-sso-is-enabled). If you use Directory Sync, learn how to [keep adding external users](/platform-config/people/directory-sync#membership-source) alongside your directory.
  </Accordion>

  <Accordion title="What happens if our IdP is down? How does our admin get in?">
    Users on your verified domains sign in only through your IdP, so they can't sign in to Profound until your IdP is back. There's no separate emergency password for admins.

    If the outage lasts, contact [customer support](mailto:support@tryprofound.com). Profound can turn off SSO enforcement for your organization so your users sign in with email and password, and turn it back on when your IdP recovers. Users who have only ever signed in through SSO have no password yet and set one with **Forgot password?** on the sign-in page.
  </Accordion>

  <Accordion title="Can our IdP groups map to Profound roles or category access?">
    Not currently. Roles and category access are managed in Profound. Members provisioned through [Directory Sync](/platform-config/people/directory-sync) start with the Member role, and Admins [change roles](/platform-config/people/roles-and-permissions) and category access in Profound afterwards.
  </Accordion>

  <Accordion title="Does SSO create user accounts automatically, or do we still invite everyone?">
    SSO handles sign-in only. It doesn't add users to your organization on its own, so a user needs to be a member or have a pending invitation before they can sign in through your IdP.

    To stop inviting users manually, set up [Directory Sync (SCIM)](/platform-config/people/directory-sync). It provisions everyone your IdP assigns to Profound and removes access when your IdP unassigns or deactivates them. SSO and Directory Sync are independent: enable either one or both. With both enabled, new members sign in directly through your IdP and no invitation email is sent.
  </Accordion>

  <Accordion title="Is there a test or sandbox organization where our IT team can trial the setup before touching production?">
    No. Testing happens in your own Profound organization, and no separate test organization is needed.

    The setup is safe to trial in production:

    * Your team keeps signing in as usual until you enable SSO in the last step of the setup.
    * The portal's test sign-in only affects the account you test with, and you can run it as many times as you need.
    * You can exit the portal and come back anytime, and you can select **Reset Connection** to start over.
  </Accordion>

  <Accordion title="SAML or OIDC: which should we use, and can we switch after starting the setup?">
    Profound supports both. Use whichever protocol your IdP and IT team prefer: the portal's instructions cover both, and the setup steps are otherwise the same.

    To switch protocols or IdPs, select **Reset Connection** in the SSO configuration portal and follow the prompts, then start the IdP step again with the new choice. Do this before you enable SSO, so your team's sign-in isn't affected.

    If your users authenticate through an authorization server you run yourself, such as an Okta custom authorization server, use the custom OIDC option. See [Configure SSO with a custom OIDC connection](/platform-config/authentication/sso-custom-oidc).
  </Accordion>

  <Accordion title="Can we enforce MFA, password policies, or device and network restrictions through SSO?">
    Yes, in your IdP. With SSO, your IdP authenticates the user and Profound accepts the result. Profound doesn't configure, enforce, or verify multi-factor authentication (MFA), managed-device requirements, network or location restrictions, or password rules for SSO users, so set them up in your IdP.

    MFA isn't available for password sign-in in Profound. See [Controls your identity provider handles](/platform-config/authentication/sign-in-security#controls-your-identity-provider-handles).
  </Accordion>
</AccordionGroup>