Skip to main content
Available on: the Enterprise planFind it in: Settings in the organization name menu at the top left of the screen > Security > Enterprise SetupRequired role: Admin or custom
Enterprise Single Sign-On (SSO) lets users sign in with their corporate identity provider (IdP) credentials, such as Microsoft Entra ID, Okta, or Google Workspace. Profound keeps their user data synchronized with the IdP.
QUICK FACTS
  • One Profound organization = one SSO connection. If your company has multiple Profound organizations, follow the SSO setup guides in this section to configure a separate SSO connection for each of them.
  • You can use the same domain for multiple SSO connections. One email domain can back the SSO connections of several organizations.
  • Read the SSO FAQ for answers to the most common setup questions, from where to find the connection values to how SSO works with multiple organizations.

​
Supported protocols

Profound supports multiple protocols for enterprise SSO, including Security Assertion Markup Language (SAML) and OpenID Connect (OIDC). Setup is tailored to your IdP, and custom SAML and OIDC connections are available if your provider isn’t among the commonly supported options or you run your own OIDC authorization server.

​
Domain matching and subdomain support

Authenticating with SSO requires the user’s email domain to match the exact domain the connection is configured with. For example, a user with the email address john-smith@tryprofound.com can use SSO only with the tryprofound.com domain. Verifying a root domain (like tryprofound.com) doesn’t cover its subdomains (like dev.tryprofound.com). Verify each subdomain your users sign in with, and your SSO connection covers it like any other verified domain. Profound uses your verified domains to confirm that a user signing in belongs to your organization. You verify a domain by adding a DNS TXT record with a token generated by Profound. Learn more in Domain verification.

​
SSO and Directory Sync

SSO lets your IdP handle how users sign in. To also let it control who has access, with users provisioned and deprovisioned automatically, set up Directory Sync. The features are independent: enable either one or both.

​
Security controls

Your IdP decides how users prove who they are. You configure and enforce requirements such as multi-factor authentication (MFA), managed devices, network or location restrictions, and password rules in your IdP, and Profound accepts the result of that sign-in. See Sign-in security and password requirements for what Profound enforces for password accounts and how sign-in works once SSO is enabled.

​
Getting started

Follow the Configure SSO guide to set up SSO for your organization. If you need help, contact customer support.