--- title: Single Sign-On (SSO) with SAML 2.0 and OpenID Connect | HelpRange url: https://www.helprange.com/feature-sso --- Single sign-on (SSO) # Your team signs in through your identity provider **Short answer:** Yes – HelpRange supports single sign-on with SAML 2.0 and OpenID Connect (Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin, JumpCloud): verified company domains, just-in-time accounts, SCIM 2.0 provisioning, single logout, encrypted SAML assertions and “Require SSO”. On the Unlimited plan ($174 per team a month) and the Deal Room Pass. Connect HelpRange to the identity provider your company already uses. Your team signs in with their work account, new colleagues get access on their first sign-in, and when someone leaves, you switch them off in one place. [Start free trial](https://www.helprange.com/#signUpSection) [Live demo](https://www.helprange.com/demo) [See pricing](https://www.helprange.com/pricing) ### SAML 2.0 and OpenID Connect Pick the protocol your identity provider prefers. Copy the values HelpRange shows into your provider and paste back its metadata or issuer – no support ticket needed. ### Works with the providers you use Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin, JumpCloud and other providers that follow the standards. ### Verified company domains Prove each e-mail domain with a DNS TXT record. Only addresses in your verified domains can sign in through your SSO, whatever the provider sends. ### Just-in-time accounts Colleagues from your domains join the team on their first SSO sign-in with the role you choose – optionally up to a member limit. ### Require SSO Turn off password and Google sign-in for members in your domains and end their open password sessions. The team owner keeps a password as a break-glass account. ### SCIM provisioning Okta and Microsoft Entra ID create, update and switch off members automatically through SCIM 2.0. Switching someone off ends their sessions; their documents stay with the team. ### Single logout Signing out of HelpRange signs people out of your identity provider, and signing out there ends their HelpRange sessions – with SAML and OpenID Connect. ### Encrypted SAML assertions HelpRange publishes its own certificate, so your provider can encrypt assertions – and you can require encryption. ### Sign-in log Administrators see the latest SSO sign-ins and refused attempts, with the reason, on the SSO settings page. ## Good to know before you switch it on ### SCIM groups Groups sync from your identity provider, but roles and folder access are still set in HelpRange. ### SHA-256 or stronger Signatures must use SHA-256 or stronger; SHA-1 is rejected. ### For your team, not your guests SSO is how your team members sign in. Data room guests and readers still confirm their e-mail with a one-time code. How it works **1. Open Settings → SSO** As a team administrator on Unlimited or the Deal Room Pass. **2. Connect your provider** SAML 2.0 or OpenID Connect – copy the values shown into your identity provider. **3. Verify your domain and switch it on** Add the DNS TXT record, turn SSO on and, if you want, require it. Single sign-on is part of the Unlimited plan ($174 per team per month) and the Deal Room Pass ($199 once for 90 days). It is not part of the trial, Pro or Max. A team that moves to a lower plan keeps its settings, but SSO stops applying – nobody is locked out. [Plans & pricing](https://www.helprange.com/pricing) FAQ ## Single sign-on (SSO) – questions Which identity providers work? Any provider that supports SAML 2.0 or OpenID Connect – for example Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin and JumpCloud. Do data room guests sign in with SSO? No. SSO is for members of your team. Guests and readers confirm their e-mail with a one-time code, as before. What happens to people who already have a password? They can keep using it until you turn on “Require SSO”. Then members in your verified domains sign in only through your identity provider – except the team owner, who keeps the password as a break-glass account. Can the sign-in start in the identity provider? Yes, when you allow IdP-initiated sign-in in the SAML settings. Otherwise people start from “Sign in with SSO” on the login page or from your team’s direct login address. Can someone from another company join my team through SSO? No. Only e-mail addresses in domains your team has verified with a DNS record can sign in, and an account that belongs to another HelpRange team is never moved into yours. Do you support SCIM? Yes. Generate a SCIM token in Settings → SSO and paste it with the SCIM base URL into Okta or Microsoft Entra ID: people are added, updated and switched off automatically. The last administrator cannot be switched off. What are the limits? Signatures must be SHA-256 or stronger, SCIM groups do not set roles or folder access, and a team can verify up to 20 domains. Related [Security & Trust](https://www.helprange.com/security)[Two-Step Login & Google Sign-In](https://www.helprange.com/feature-two-factor-authentication)[IP allow-lists and device limits](https://www.helprange.com/feature-ip-device-limits)[Deal Room Pass](https://www.helprange.com/deal-room-pass)[Pricing](https://www.helprange.com/pricing) ## Try it on your own documents 3-day free trial, then a free plan. No credit card required. [Start free trial](https://www.helprange.com/?from=feature-cta#signUpSection) [Compare plans – from $39 per team](https://www.helprange.com/pricing?from=feature-cta)