SAML SSO

With SSO, you can streamline user management across systems, and remove the need for end-users to remember and manage multiple passwords by allowing them to sign in at one single access point and enjoy a seamless experience across multiple applications.

To use SSO with Notion:

• Your workspace must be on a Business plan or Enterprise plan.

• Your Identity Provider (IdP) must support the SAML 2.0 standard. See instructions for Identity Provider setup for specific apps here →

• A workspace owner must configure SAML SSO for the Notion workspace.

• At least one domain must be verified by a workspace owner. Learn more about domain verification →

To set up SAML SSO for a Business workspace, a workspace owner can:

1. Go to Settings → General.

2. In the Allowed email domainssection, remove all email domains.

3. Select the Identity tab in Settings.

   

4. Verify one or more domains. See instructions for domain verification here →

5. Toggle on Enable SAML SSO and the SAML SSO Configuration modal will automatically appear and prompt you to complete the set-up.

6. The SAML SSO Configuration modal is divided into two parts:

   • The Assertion Consumer Service (ACS) URL needs to be entered in your Identity Provider (IdP) portal.

   • The Identity Provider Details is a field in which you need to provide either an IdP URL or IdP metadata XML.

7. Choose how people sign in and whether new accounts are created for them, then select Save & enable. You can make all of these choices before you save. You don’t need to save first and open the settings again.

Enterprise plan organisation owners can manage SAML SSO for every workspace in their organisation. An organisation can have more than one SAML configuration, so different groups of people can sign in with different identity providers. This is helpful when business units, regional IT teams, or companies you’ve acquired each have their own provider.

To add a new SAML configuration:

1. Open the workspace switcher and select Manage organisation. You may need to select Set up organisation first if you haven’t already. Learn more about organisation level controls here →

2. In the General tab of your organisation settings, click SAML configurations. You’ll see every SAML configuration your organisation has.

3. Select Create configuration and give it a name your team will recognise, like the business unit or provider it belongs to.

4. Select Enable SAML SSO for login to set this as a login option for the selected email domains.

5. Set the Login method for the people this configuration covers. Choose Any method to let users sign in with this SAML as an additional login option, or Only SAML SSO which requires users to sign in with this SAML only.

6. Select Automatic account creation to automatically create accounts for new SAML SSO users who sign up using one of the selected email domains.

7. Choose one or more verified email domains for the configuration. Adding a verified domain means any user that logs in with that domain will be able to use this SAML. A domain has to be verified before you can add it. See instructions for domain verification here →

8. Copy the Assertion Consumer Service (ACS) URL for this configuration and add it in your identity provider. Each configuration has its own ACS URL, so give each provider its own app on their side.

9. Copy the SAML SSO Entity ID for this configuration and add it to your identity provider.

10. Choose whether to add your provider’s details with an IdP metadata URL or IdP metadata XML.

11. Paste the URL from your IDP, then save.

Once you have completed your configuration of SAML SSO for a workspace, members will be able to log in via SAML SSO in addition to other login methods, like username and password or Google authentication.

You can pick this while you are first setting up SAML, in the same save. You can also change it later.

If you want to ensure that members can log in using only SAML SSO and no other method, go to your SAML SSO settings and update the Login method to Only SAML SSO. Once this happens, workspace users will be logged out and required to log back in using SAML SSO. SAML SSO will only be enforced for members who use your verified domain.

On the Enterprise plan, you set this for each configuration. Setting the Login method to Only SAML SSO applies to the domains in that configuration and leaves your other configurations alone. A domain can be part of several configurations, but only one of them can be required at a time.

On the Business plan, this will look like this:

On the Enterprise plan, this will look like this:

In the event of IdP or SAML failure, certain users will be able to bypass SAML SSO by using their email and password credentials. They’ll be able to log in and disable or update their configuration.

• If a SAML configuration is managed at the organisation level, only organisation owners will be able to bypass SSO.

• If a SAML configuration is managed at the workspace level, only workspace owners will be able to bypass SSO.

This works the same when your organisation has more than one configuration. An organisation owner can sign in with an email and password, then fix, turn off, or stop requiring the configuration that is causing the problem.

Workspace-level SAML authorisation allows enterprises to require SAML SSO for workspace access, regardless of a user's email domain. This enables safer external collaboration in your workspace.

To enable workspace-level SAML authorisation:

1. Open the workspace switcher and select Manage organisation. You may need to Set up organisation first if you haven’t already. Learn more about organisation level controls here →

2. In the General tab of your organisation settings, select SAML configurations.

3. In the list of workspaces, pick which SAML configuration each workspace requires. You can leave a workspace without one.

When enabled, members of the affected workspaces who haven’t already authorised with your organisation’s IdP will be met with an additional authorisation screen. They’ll need to go through SAML SSO to continue viewing your organisation’s workspaces.

If a workspace requires a specific configuration, members who haven’t signed in with that provider yet are asked to do it when they open the workspace. Notion brings them back to the workspace once they’re done. Someone who works in two workspaces that require different providers may be asked to sign in to each one.

Notion supports Just-in-Time provisioning when using SAML SSO. This allows someone signing in via SAML SSO to join the workspace automatically as a member. You can turn this on while you set up SAML, in the same save.

To enable Just-in-Time provisioning if you're on the Business plan, go to Settings→Identity and make sure that Automatic account creation is enabled.

To enable Just-in-Time provisioning if you’re on the Enterprise plan, go to your organisation settings → General and make sure that Automatic account creation is enabled.

On the Enterprise plan, you can turn Automatic account creation on or off for each configuration. The workspace that new people are added to is set for the whole organisation, so it’s the same no matter which provider they used. Give people access to other workspaces the way you normally would.

• Business plan workspaces use one configuration. Enterprise plans allow for more than one SAML configuration.

• An organisation can have up to 25 configurations. There is no limit on verified domains.

• A verified domain can be part of several configurations, but only one of them can be required at a time.

• A parent domain does not cover its subdomains. Verify each domain and subdomain you want to send to a provider, then add it to a configuration.

• An email domain can belong to only one Notion organisation. Two organisations can't share it.

• Only organisation owners, and admins who already manage SAML, can add or change configurations. Members can’t.