Setting Up Single Sign-On

Set up single sign-on (SSO) so your team signs into Lavalier with your company's identity provider. Lavalier uses the SAML 2.0 standard, and SSO can only be set up by an account Owner. The same page also lets you provision users automatically with SCIM.

Before You Start

• Owner permissions in Lavalier (anyone else sees an "owner only" message).
• SSO enabled for your account. SSO is part of your plan—if you're an owner and don't see it in Settings, contact your Lavalier account team.
• A SAML 2.0-compatible identity provider (IdP) such as Okta or Microsoft Entra.
• Access to add a DNS TXT record for your email domain.
  
  

Step 1: Open SSO Settings

Go to Settings → SSO & Provisioning.

Step 2: Verify Your Email Domain

You need a verified domain before you can turn SSO on. Verified domains are how teammates get routed to SSO by their email address.

1. Under Verified domains, add your domain (e.g., acme.com). A Verify [domain] dialog opens automatically with the DNS TXT record you need to add.

2. In the dialog, copy the Name / host and Value, then create a DNS TXT record with them at your DNS provider.

3. Once the record has propagated, click Verify in the dialog. If you closed it, click Set up DNS on the domain row to reopen it.
   
   

Step 3: Add Your IdP's Metadata

Open the setup dialog and choose one method:

• Upload the metadata file (easiest): Click Upload metadata XML and select your IdP's metadata file. Lavalier auto-fills the fields for you.

• Enter it manually: Under or enter manually, fill in:

  1. Your IdP's Entity ID
  2. Your IdP's Sign-On URL
  3. The IdP signing certificate (PEM)
     
     

Step 4: Give Your IdP Lavalier's Details

In the same dialog, open Service provider details and copy these into your IdP:

1. Entity ID
2. ACS URL
3. Sign-in URL — set this as the app's sign-on URL in your IdP so members can launch Lavalier from their dashboard.

You can also download Lavalier's certificate (.pem) or the full metadata XML, which most IdPs accept directly.

Step 5: (Optional) Adjust Advanced Options

Expand Advanced SAML options only if you need to:

• Map non-standard attributes (Email, First name, Last name)
• Turn on Sign AuthnRequests (recommended)
• Turn on Require encrypted assertions

Most setups can leave these at their defaults.

Step 6: Test the Connection

Click Test SSO sign-in to confirm everything works end-to-end before you turn SSO on.

Note: The first time someone signs in through SSO, Lavalier creates their account automatically (just-in-time provisioning) with the Team Member role—no invitation email needed.

Step 7: Turn SSO On

1. Flip the Use single sign-on switch.

2. If an Enable SSO? warning appears, some people on your verified domains already have Lavalier accounts in another organization. Add them to your identity provider first, or they'll be locked out—then confirm.

3. Lavalier shows your recovery codes once. Save them immediately (see the next section).
   
   

How enforcement works:

• Everyone with an email on a verified domain must use SSO—including owners. There's no owner-bypass toggle.
• Users on unverified domains aren't affected. The page shows how many they are and confirms they won't be required to use SSO.
• You can't remove your last verified domain while SSO is on. Turn SSO off, or verify another domain first.
  
  

Step 8: Save Your Recovery Codes

Recovery codes let an owner sign in if your identity provider is ever unavailable.

1. When SSO is first enabled, Lavalier reveals a set of codes under Your recovery codes—shown once.

2. Save them now, ideally in a password manager. They can't be retrieved later.
   
   

Good to know:

• Each owner has their own set, and each code works once.
• Manage codes anytime with the Manage recovery codes link: Generate, Regenerate (revokes the old set), or Revoke all.
• Locked out? Open the recovery sign-in page, enter your email and a code, and open the emailed sign-in link within 15 minutes.
  
  

Provision Users Automatically (SCIM)

The SSO & Provisioning page also supports SCIM, which lets your identity provider create, update, and deactivate Lavalier users automatically.

• The SCIM section appears once you've set up SAML.
• The Enable SCIM toggle unlocks once SSO is on.

See Setting Up SCIM Provisioning for the full setup.

What Your Team Sees

Once SSO is enabled, teammates enter their work email on the login page and are routed to your identity provider to sign in. You can also share the direct /sso/<slug> link as a bookmark or an app tile in your IdP.

What's next?

• Inviting Users and Managing Permissions — Manage who has access and what they can do
• Setting Up Your Company OS — Configure the rest of your account settings
  
  

Troubleshooting