SSO and directory sync

Single sign-on (SSO) lets members sign in to your team through your identity provider, such as Okta or Microsoft Entra ID. Directory sync adds and removes members as your directory changes and gives them roles from their groups. Both are part of the Enterprise plan on Voidhash Cloud; see pricing.

Open Settings → Team → Security. Only admins and the owner see this page, and only in Studio: the CLI, agents and API keys can't change it. If you last signed in more than 30 minutes ago, a change asks you to sign in again first. Each section opens your identity provider's setup page (run by WorkOS, the sign-in service Voidhash uses) in a new tab. On a deployment without SSO support, the page says "Single sign-on and directory sync aren't available on this deployment of Voidhash."

Single sign-on

Require SSO

Turn on Require SSO and members can use the team only after signing in through its SSO. A session that wasn't signed in through it no longer sees the team until the member signs in again through SSO.

You can turn it on only with an active SSO connection and while you're signed in through it, so you can't lock yourself out. The owner is always exempt and can still sign in another way.

Directory sync

Click Set up directory sync and connect your directory on the setup page. From then on, people are added to the team and removed from it as your directory changes. Click Manage directory to change the connection.

A synced member's role comes from their directory groups:

• Groups lists your directory's groups. Give each one Member, Admin or Default role.
• Default role (Member or Admin) applies to people whose groups give no role. It starts as Member.

Synced members show a Directory badge on Settings → Team → Members. You can't change their role or remove them there; change their groups in your identity provider. Directory sync never changes or removes the owner.

Studio has no two-factor or multi-factor authentication (2FA, MFA) setting of its own; enforce it in your identity provider.

If something's off

• Require SSO can't be turned on: your SSO connection isn't Active, or you didn't sign in through it in this session. Sign out and sign back in through SSO.
• A member is locked out after requiring SSO: they need an account in your identity provider with an address on a verified domain.
• You can't change a member's role: they're synced from your directory; change their groups in your identity provider.

Next steps

• Members and roles
• Audit log
• Your account