💡 This feature is only available with Feishu Enterprise edition. To learn more, please contact Support or your Customer Success Manager.

I. Intro

This feature is suitable for enterprises with SAML 2.0 protocol IdP. It allows team members to log in to Feishu with an existing internal company account without registering a new Feishu account. This article uses Okta IdP as an example to demonstrate how to set up SAML 2.0 SSO login.

Please note that to successfully set up Feishu SSO login, the email address in Feishu Contacts needs to match the email address in Okta. If they do not already, please make sure that the two email addresses match.

II. Steps

Before the administrator can set up SSO login in the Feishu Admin Console, they must first set up relevant configurations in Okta. Please note that only primary administrators can complete the following steps.

1.Set up Okta

Go to Okta and click Admin in the upper right corner.

After logging in, go to Applications > Applications.

In the upper left corner, click Add Application.

In the upper right corner, click Create New App.

In the pop-up window, select Web and SAML 2.0, and click Create.

In the next window, insert a name under App name. You can choose to use Feishu. Once you've named the app, click Next.

On the next page, enter the following links in the corresponding boxes shown in the image below.

A link: https://www.feishu.cn/suite/passport/authentication/idp/saml/call_back

B link: https://www.feishu.cn

Note: Please copy and paste the links directly into the boxes on the page. There is no need to click on the links.

Scroll down and click Add Another under Attribute Statements (Optional). Please add user.email as shown in the image below.

Scroll down and click Next.

On the next page, select the options as shown in the image below, and click Finish when you're done.

Under Applications > Assignments, click Assign in the upper left corner to add the members who need to use this application.

In the Sign On page, click View Setup Instructions.

The following 3 parameters will be used in Feishu Admin Console.

Note: The third parameter does not include “BEGIN CERTIFICATE” and “ END CERTIFICATE”. Please only copy and paste the main text in the middle.

2.Set up a custom company domain name

Once Okta is set up, the administrator can log in to Feishu Admin Console. If you'd like to set a domain name for members to login with, you can do this by clicking Settings > Company Info > Edit.

3.Set up SSO account login

Go to Settings > SSO account login. Copy and paste the 3 parameters you obtained from Okta into the corresponding boxes according to the images shown below (How to obtain the parameters). Click Save configuration.

Click Enable login with Okta account.

You've completed SSO login setup. Try logging in to Feishu now using SSO login.

4.Log in (For all organization members)

You can use SSO login on both desktop and mobile. Download the latest version of Feishu, click Sign in with SSO, and enter your company's domain name.

Log in to Okta using the email and password you used in Okta.