> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.usepassport.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.usepassport.ai/_mcp/server.

# Set up SSO for your Passport team

Set up single sign-on (SSO) so your team can sign in to Passport with your organization's identity provider, such as Okta. As a Passport Admin, you configure SSO from **Org Settings** in two steps: verify a domain, then set up the SSO connection. Each step opens a new browser tab where you complete the configuration.

To open SSO setup, click **Org Settings**, then select **Authentication**.

## Step 1: Verify a domain

Verify a domain you own before you connect an identity provider.

To verify a domain, do the following:

1. Click **Org Settings**, then select **Authentication**.
2. Click **Verify a domain**. This opens a new browser tab.
3. In the new tab, enter your domain and click **Continue**.
4. Add the DNS TXT record provided to your domain's DNS settings.

The domain shows as pending in the **Authentication** tab until the DNS record is verified. While a domain is pending, you can click **Retry verification**, or delete the domain and start again.

## Step 2: Set up the SSO connection

After a domain is verified, connect your identity provider. You must verify at least one domain before setting up the SSO connection.

To set up the SSO connection, do the following:

1. Click **Org Settings**, then select **Authentication**.
2. Click **Set up SSO connection**. This opens a new browser tab.
3. In the new tab, follow the steps to connect your identity provider.

Once the connection is active, your team can sign in to Passport with SSO. The **Authentication** tab shows the connected identity provider.

## Manage your SSO connection

The **Authentication** tab shows your active SSO connection and its identity provider. To remove SSO, click **Delete** and confirm.

Your verified domains are locked while SSO is active. To change domains, delete the SSO connection first.