> ## Documentation Index > Fetch the complete documentation index at: https://basedash.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Domains and SSO > Add your own domains, configure SSO, and manage enterprise identity > [!NOTE] > > Available on the [Enterprise plan](/docs/administration/pricing). You can log in or have new members sign up to Basedash using single sign-on (SSO). You will first need to add a domain and verify it before you can configure SSO for your organization. ## Domains To add a domain, open **Settings → Security** and, in the **SAML SSO** section, click **Add domain**. Then verify it by adding a TXT record in your domain provider's interface. See [Domains and login methods](/docs/administration/domains-and-login) for how domains affect sign-in and joining. ![The verified example.com domain expanded under SAML SSO, with its TXT subdomain and value, Auto join and SSO turned on, the ACS URL, and the Edit SSO XML button](https://mintcdn.com/basedash/aH3kb-Bl5OLwdg2n/images/administration/sso/domain-settings.webp?fit=max\&auto=format\&n=aH3kb-Bl5OLwdg2n\&q=85\&s=0c02865542c86214d30484a91f9727b9) ### TXT record verification We provide both a TXT subdomain and a TXT value that you must add to your domain provider's interface. Then, you can click the option in Basedash to check the domain's verification status. Once your domain passes the verification check, you will be able to enable domain-related features such as auto-join and SSO. ### Auto join Once your domain is verified, you can enable auto-join. This allows any user who signs up or logs in with an email at your verified domain to automatically have access to your organization. ### SSO Once your domain is verified, you can enable SSO. Basedash supports SSO with SAML 2.0 and OIDC. For SAML setups, add your SSO provider's XML metadata, which we use to configure the connection with your SSO provider. We provide an ACS URL that you will need to enter on your SSO provider's side to complete the setup. If you encounter any difficulties, please contact us for more details. Once SSO is properly configured, users will only be able to log in and sign up with emails at your verified domain using your SSO provider's login flow. #### Supported SSO providers Basedash supports major identity providers that use SAML 2.0 or OIDC. This includes: * Okta * OneLogin * JumpCloud * Rippling * Ping Identity * Auth0 * Microsoft Entra ID (formerly Azure AD) * Google Workspace If your identity provider supports SAML 2.0 or OIDC, it will work with Basedash. Contact us if you need help configuring your specific provider. ### SCIM provisioning Organizations can use SCIM to provision users, groups, and group memberships from a compatible identity provider. See the [SCIM provisioning guide](/docs/administration/scim) for supported operations and setup instructions. ## FAQ > **Can people at our domain still sign in with Google or an email code?** > > No. Once SSO is on for a domain, everyone with an email at that domain is > sent to your identity provider, including admins. Make sure at least one > admin can sign in through your identity provider before you turn it on. > **Are accounts created automatically on first SSO sign-in?** > > Yes, Basedash creates the account. If **Auto join** is on for the domain, > the person joins your organization as a Member. If it's off, invite them > first, or they'll end up outside your organization. > **Can contractors with other email domains still sign in?** > > Yes. SSO only applies to emails at the domains where it's turned on. Others > sign in with an email code or Google, unless your organization requires > Google sign-in. See [Domains and login > methods](/docs/administration/domains-and-login). > **Can we use SSO for more than one domain?** > > Yes. Add each domain in **Settings → Security**. Each one has its own SSO > setting and identity provider metadata, so different domains can use > different identity providers. ## Self-hosting support Self-hosted deployments support SSO with compatible SAML 2.0 and OIDC identity providers. They also support SCIM without any SCIM-specific environment variables. Use your deployment's base URL when following the [SCIM provisioning guide](/docs/administration/scim). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.