> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinq.me/llms.txt
> Use this file to discover all available pages before exploring further.

# How SAML SSO works

> What changes when your team signs in to Blinq through your identity provider, and what to set up before you start.

<Info>
  SSO is available on **Enterprise** plans. Your domains are enabled by the Blinq team. [Talk to your account team](mailto:support@blinq.me) to get started.
</Info>

Blinq supports single sign-on over **SAML 2.0**. Your identity provider holds your team's accounts and credentials, and Blinq acts as the service provider.

This page covers what happens inside Blinq. It applies the same way whichever identity provider you use.

## Before you start

<Steps>
  <Step title="Register your domains with Blinq">
    Email [support@blinq.me](mailto:support@blinq.me) with the domains you want covered and an example address for each. Blinq adds them for you — there's no self-serve screen for this. You can register more than one domain, including subdomains, and add or remove them later.
  </Step>

  <Step title="Confirm you're the workspace Owner">
    The SAML settings are reached from the Blinq dashboard under **Settings → SAML**.
  </Step>

  <Step title="Open Blinq and your identity provider side by side">
    Setup copies values in both directions, so keep both open in separate tabs.
  </Step>
</Steps>

<Warning>
  **Register your domains first.** Until at least one domain is registered, the SAML settings show an upgrade prompt — even on an Enterprise plan. If you're on Enterprise and being told to upgrade, a missing domain is the reason, not your subscription.
</Warning>

## Configuring safely

<Warning>
  **Stay signed in to Blinq while you configure SSO, and test in a separate browser or a private window.** A misconfigured certificate or URL can lock you out of the workspace you're editing, and only Blinq support can switch enforcement back off.
</Warning>

## What enforcement changes

Enforcement is the switch that makes SSO mandatory. It's checked on Blinq's side against the email domain someone signs in with.

| Behaviour                                  | With enforcement on                                               |
| ------------------------------------------ | ----------------------------------------------------------------- |
| Sign-in options for your domains           | Only **Continue** — the password and email code options disappear |
| Password and email code sign-in            | Blocked for addresses on your registered domains                  |
| Claiming a card for the first time         | Also goes through your identity provider                          |
| People whose address isn't on your domains | Unaffected — they keep signing in as before                       |
| Multi-factor authentication                | Handled by your identity provider, not by Blinq                   |

Because enforcement is matched on the email domain, someone who signs in with an address outside your registered domains isn't routed through SSO at all.

## Claiming a card under enforced SSO

Enforcement applies from the very first time someone accesses Blinq, not only on later sign-ins. Claiming a card uses the same sign-in path as everything else, so a new team member on one of your registered domains is sent to your identity provider when they follow their activation link.

There's no separate password or email code step for new joiners to route around.

<Info>
  **Allowed email domains and SAML SSO are mutually exclusive.** The allowed-domains setting, which limits who can join by invite link, is hidden once SAML SSO is enabled on a workspace.
</Info>

## Starting from your identity provider

By default, people start at Blinq: they enter their email address, and Blinq redirects them to your identity provider to sign in.

You can also let people launch Blinq from a tile in their identity provider's app dashboard. This is an opt-in setting, and Blinq support enables it for your workspace.

<Warning>
  **Launching from the app tile currently requires enforcement to be switched on as well.** With enforcement off, that route returns a server error rather than signing the person in. If you want the app tile without enforcing SSO for everyone, talk to support before rolling it out.
</Warning>

## Setup guides

<Columns cols={3}>
  <Card title="Microsoft Entra ID" icon="https://mintcdn.com/blinq/lALxyhxd65UJV5hO/images/identity/entra/logo.png?fit=max&auto=format&n=lALxyhxd65UJV5hO&q=85&s=c8de2e97914f5f6974e9318fbc6f28b7" href="/identity/sso/entra" width="256" height="256" data-path="images/identity/entra/logo.png">
    Add the Blinq enterprise application and exchange SAML details.
  </Card>

  <Card title="Okta" icon="https://mintcdn.com/blinq/lALxyhxd65UJV5hO/images/identity/okta/logo.png?fit=max&auto=format&n=lALxyhxd65UJV5hO&q=85&s=b77c6133f5cb189c6785a502f48c8a98" href="/identity/sso/okta" width="256" height="256" data-path="images/identity/okta/logo.png">
    Create a SAML 2.0 app integration and exchange SAML details.
  </Card>

  <Card title="Google Workspace" icon="https://mintcdn.com/blinq/E_nBaaBkh08-xrJe/images/integrations/google-workspace/logo.png?fit=max&auto=format&n=E_nBaaBkh08-xrJe&q=85&s=510ebf897f14fe836ef13bb799f0ad2e" href="/identity/sso/google-workspace" width="256" height="256" data-path="images/integrations/google-workspace/logo.png">
    Create a custom SAML app and exchange SAML details.
  </Card>
</Columns>

<Card title="Troubleshooting" icon="wrench" href="/identity/sso/troubleshooting">
  Sign-in failures, certificate errors, and people who can't reach the settings.
</Card>

<hr />

### Need help?

For any questions or issues, [contact Blinq support](https://support.blinq.me/en/) or email [support@blinq.me](mailto:support@blinq.me).