> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Single Sign-On (SSO) overview

> Supported protocols, scope, and how to get started with SSO configuration

Enterprise Single Sign-On (SSO) lets users sign in with their corporate identity provider (IdP) credentials, such as Azure AD, Okta, or Google Workspace. Profound keeps their user data synchronized with the IdP.

<Note>
  SSO is available for customers on the Enterprise plan. Setup requires the Admin role in your Profound organization. Learn more in [Roles and permissions](/platform-config/people/roles-and-permissions).
</Note>

## Supported protocols

Profound supports multiple protocols for enterprise SSO, including Security Assertion Markup Language (SAML) and OpenID Connect (OIDC). Setup is tailored to your IdP, and custom SAML and OIDC connections are available if your provider isn't among the commonly supported options.

## Subdomain support

Authenticating with SSO requires the user's email domain to match the exact domain the connection is configured with. For example, a user with the email address `john-smith@tryprofound.com` can use SSO only with the `tryprofound.com` domain.

Subdomains (like `dev.tryprofound.com`) cannot use the same SSO connection as root domains, so each subdomain needs its own connection.

## SSO scope

SSO is configured per Profound organization. If your company operates multiple Profound organizations, each one needs its own SSO connection.

If your organizations share members, such as agency or contractor accounts, or have an otherwise non-standard configuration, contact your Engagement Manager for setup assistance.

## Getting started

Follow the [Configure SSO guide](/platform-config/authentication/configure-sso) to set up SSO for your organization. If you need help, contact [customer support](mailto:support@tryprofound.com).