# Set up single sign-on

> Single sign-on (SSO) allows users to access many service providers using a single username and password by relying on a single identity provider.

> For the complete documentation index, see [llms.txt](https://docs.talon.one/llms.txt).

<FeatureAccessInfoBox/>

When single sign-on is enabled, users of an organization can sign in to Talon.One
directly with their identity provider user account.

The steps to set up single sign-on depend on the identity provider. To learn how to set up
single sign-on with different providers, see [these tutorials](/docs/dev/tutorials/single-sign-on.md).

## Enable single sign-on

:::important
- Talon.One only supports [Service-provider-initiated SSO](https://kinde.com/learn/authentication/types-and-methods/sp-vs-idp-initiated-sso/#what-is-sp-initiated-sso) and not [Identity-provider-initiated SSO](https://kinde.com/learn/authentication/types-and-methods/sp-vs-idp-initiated-sso/#what-is-idp-initiated-sso).
- Enabling single sign-on automatically disables [two-factor authentication](/docs/product/account/account-settings/set-up-2fa.md)
  for all users of your organization.
- You cannot disable single sign-on in the Campaign Manager. To disable it, contact our [support team](mailto:support@talon.one).
:::

After you have [set up single sign-on](/docs/dev/tutorials/single-sign-on.md) on both the
identity provider side and the Talon.One side, you can enable it for all users of your
organization.

To enable single sign-on, in Talon.One, in <Account className="icon"/> **Account** > <Org className="icon"/> **Organization** > **Single Sign-On**, click **Enable Single Sign-On**. Single sign-on is enabled immediately.

:::note
- When single sign-on is enabled but not [enforced](#enforce-single-sign-on), users can
continue to sign in to Talon.One using their email and password. However, after they sign
in once using single sign-on, they cannot use their email and password to sign in anymore.
- If you use more than one identity provider for your organization, you can set up multiple
single sign-on connections. For details, contact our [support team](mailto:support@talon.one).
:::

## Enforce single sign-on

:::important
Enforcing single sign-on is a permanent action. When single sign-on is enforced, users of
your organization can sign in to Talon.One only with the domains specified in the setup.

Enforce single sign-on only when you are sure that the setup is correct and signing in
works as expected.
:::

After you have [set up single sign-on](/docs/dev/tutorials/single-sign-on.md) on both the
identity provider side and the Talon.One side, you can enforce it for all users of your
organization.

To enforce single sign-on:

1. In Talon.One, in <Account className="icon"/> **Account** > <Org className="icon"/> **Organization** > **Single Sign-On**,
   select the **Enforce single sign-on** checkbox.
1. Click **Enable Single Sign-On**.
1. In the pop-up that appears, click **Enable Single Sign-On**.

You can also enforce single sign-on later while [editing the setup](#edit-the-single-sign-on-setup).

## Edit the single sign-on setup

:::note
Always ensure the setup information in Talon.One matches the information from your
identity provider.
:::

You can edit any information in your single sign-on setup, for example, the connection
name or sign-on URL.

To edit the single sign-on setup:

1. In <Account className="icon"/> **Account** > <Org className="icon"/> **Organization** > **Single Sign-On**,
   click **Edit Single Sign-On**.
1. Edit the setup as needed.
1. (Optional) If single sign-on is not [enforced](#enforce-single-sign-on), select the
   **Enforce single-sign on** checkbox to enforce it.
1. Click **Save**.

The changes to the single sign-on setup are applied immediately.

## Related pages

- [Set up single sign-on with Okta](/docs/dev/tutorials/sso-with-okta.md)
- [Set up single sign-on with Microsoft Entra ID](/docs/dev/tutorials/sso-with-microsoft-entra-id.md)