Single Sign-On (SSO)

Single Sign-On lets members log in with their company credentials instead of a separate Flint password. Configure SSO in Settings Single Sign-On.

Flint uses WorkOS for SSO, which means we support every identity provider that WorkOS supports.

Supported Providers

We support all major identity providers through WorkOS:

Enterprise SAML Providers: Okta, Azure AD, Google Workspace, OneLogin, JumpCloud, Duo, PingOne, PingFederate, ADFS, Auth0, CyberArk, Salesforce, Oracle, VMware, Rippling, and many more.

OIDC/OAuth Providers: Generic OIDC, Generic SAML, Google, Microsoft, GitHub, Apple, and others.

If your identity provider supports SAML 2.0 or OIDC, it will work with Flint.

Setting Up SSO

SSO Login Flow

1. User clicks Sign in with SSO on the login page
2. User enters their work email
3. Flint looks up the organization by email domain
4. User is redirected to their identity provider
5. After authenticating, user is redirected back to Flint
6. Flint creates a session and logs them in

SSO Enforcement

After enabling SSO, choose an enforcement level:

Default Roles

Assign default roles to new SSO users:

1. In SSO settings, configure Default Roles
2. Select one or more roles
3. New users logging in via SSO for the first time receive these roles automatically

This eliminates manual role assignment for SSO users.

Directory Sync (SCIM)

Automatically sync users from your identity provider:

1. In SSO settings, click Configure Directory Sync
2. You'll be redirected to the WorkOS Admin Portal
3. Follow the SCIM setup instructions for your IdP

With Directory Sync enabled:

• New users in your IdP are automatically created in Flint
• Updated user info syncs automatically
• Deprovisioned users lose access immediately

Managing SSO

Once configured, the SSO settings page shows:

• Connection Status — Active, Inactive, or Validating
• Identity Provider — Which IdP is connected
• Enable/Disable Toggle — Turn SSO on or off
• Enforce SSO Toggle — Require SSO for all users
• Default Roles — Roles for new SSO users
• Directory Sync — SCIM configuration status

Reconfiguring SSO

To change your IdP configuration:

1. Click Manage Connection
2. You'll be redirected to the WorkOS Admin Portal
3. Make your changes and save

Disconnecting SSO

To remove SSO entirely:

1. Disable SSO enforcement first (if enabled)
2. Click Disconnect SSO
3. Confirm the action

Users will need to set passwords to continue accessing their accounts.

Troubleshooting