📍 Available on: Enterprise edition

💡 Only primary administrators can set up this feature. The process may be relatively complicated, if you are have any further questions, please contact support. Currently this feature is only available for Enterprise edition. To obtain Enterprise edition, please contact support.

I. Intro

Single Sign-On, or SSO, is a feature that enables users to access multiple mutually-trusted application systems by just logging in once. After primary administrators enable this feature and complete the configuration process in the admin console, organization members can then use SSO to log in to Feishu directly with the company's domain. Feishu allows primary administrators to configure SSO login based on SAML 2.0 protocol.

II. Steps

First, please confirm the IdP that provides you with authentication services. Then, primary administrators can configure SSO logins based on the SAML 2.0 protocol. This also works with Okta and Google Workspace.

Learn how to configure SSO in Okta and Google Workspace:

Configure in Okta

Configure in Google workspace

III. How do members sign in with SSO?

After primary administrators complete the SSO configuration, members can select Sign in with SSO at the bottom of the login page and enter the company domain to log in to Feishu.

Note: If members don't know the company domain, they can ask administrators or colleagues who have successfully logged in.

IV. FAQs

Who can set the company domain required for login?

The company domain can be set by primary administrators or administrators with company information permissions. Go to the admin console > Settings > Company Info to view or edit the company domain (for example, in the screenshot given below, the company domain would be tomorrowbrilliant).

To learn more, check out Change the domain name of the company.

Why can't I log in to Feishu using SSO?

Please contact a primary administrator or administrators with permissions for Member and Department management, and make sure that your registered email in Feishu is the same as your IdP email.

Why can't I invite members after setting up SSO?

To ensure a smooth login for members after enabling SSO, you will only be able to add new members on the admin console (please make sure their email information is the same as their IdP email), or import using API. You can no longer invite members with the invite code, invite QR code or invite link. This is to help prevent members from entering information that's inconsistent with IdP, which will may prevent them from logging in successfully.