Once you’ve configured your identity provider (IDP), a workspace owner can enable SSO.

1. From your desktop, click on your workspace name at the top left.
   
2. Select Settings & administration from the menu, then click Workspace settings.
3. Click the Authentication tab.
4. Next to SAML authentication, click Configure.
5. In the top right, toggle Test mode on.
6. Next to SAML SSO URL, enter your SAML 2.0 endpoint URL(HTTP). (This came from setting up your connector. If Okta is your IDP, you can include the IDP URL instead if you like.)
7. Next to Identity provider issuer, enter your IDP entity ID. 
8. Copy the entire x.509 certificate from your identity provider and paste it into the Public certificate field.
9. Next to Advanced options, click Expand. Choose how the SAML response from your IDP is signed. If you need an end-to-end encryption key, tick the box next to Sign AuthnRequest to show the certificate.
10. Under Settings, decide if members can edit their profile information (like their email or display name) after SSO is enabled. You can also choose whether SSO is required, partially required* or optional.
11. Under Customise, enter a Sign-in button label.
12. Select Save configuration to finish.

*If you have guest accounts, we recommend choosing the option where SSO is partially required, so guests can still sign in using their email address and password.

Once you’ve configured your identity provider (IDP), an org owner can enable SSO for your Enterprise Grid organisation:

1. From your desktop, click on your workspace name at the top left.
   
2. Select Settings & administration from the menu, then click Organisation settings.
3. From the left sidebar, click Security. 
4. Click SSO settings.
5. Enter your SSO name.
6. Enter your SAML 2.0 endpoint URL (this came from setting up your connector earlier.) This is where authentication requests from Slack will be sent.
7. Enter your Identity provider issuer URL (also known as the entity ID). 
8. The Service provider issuer URL is set to https://slack.com by default. This field should match what you've set in your IDP.
9. Copy the entire x.509 certificate from your identity provider.
10. Choose whether the SAML responses and assertions are signed. If you require an end-to-end encryption key for your IDP, tick the box next to Sign AuthnRequest to show the certificate. You can also select your preference for AuthnContextClassRef values.
11. Click Test configuration. We'll let you know if the changes are successful or whether you need to make further changes.
12. When you're ready, click Turn on SSO or Add SSO.

Tip: After setting up SSO, you can manage single sign-on settings and learn how to connect IDP groups to workspaces in your organisation.

Add additional SSO configuration

If you’d like to, you can add up to 11 additional SSO configurations to allow people to log in to Slack from an identity provider of your choice. 

1. From your desktop, click on your workspace name at the top left.
   
2. Select Settings & administration from the menu, then click Organisation settings. 
3. From the left sidebar, select  Security.
4. Click SSO settings.
5. Click Add SSO configuration and follow the steps to set up SSO for Slack.