---
title: "Single sign-on"
description: "Sign your people in through Okta or any OpenID Connect provider, map identity-provider groups to Pyn roles, and understand what employees see at the sign-in page."
sidebar:
  label: Overview
  order: 0
area: integrations
feature: sso
appPath: /settings/integrations/available
lastVerified: 2026-10-22
version: "2026-10-16"
audience: admin
related:
  - integrations/sso/connect-okta
  - integrations/sso/connect-an-oidc-provider
  - settings/users
  - account/sign-in
intercom:
  - id: "16838066"
    title: Enabling Single Sign On (Pyn 2)
    url: https://intercom.help/pyn/en/articles/16838066-enabling-single-sign-on-pyn-2
    note: replaces
  - id: "16838252"
    title: Connect to Okta SSO (Pyn 2)
    url: https://intercom.help/pyn/en/articles/16838252-connect-to-okta-sso-pyn-2
  - id: "6002159"
    title: Connect to Okta SSO
    url: https://intercom.help/pyn/en/articles/6002159-connect-to-okta-sso
    note: "Pyn 1 article, kept for reference"
  - id: "9421970"
    title: Connect to Okta API
    url: https://intercom.help/pyn/en/articles/9421970-connect-to-okta-api
    note: "Pyn 1 article, kept for reference"
---

With single sign-on, people reach Pyn through your identity provider instead of a Google, Microsoft or magic-link sign-in. Pyn offers two integrations: **Okta**, for an Okta OpenID Connect app, and **Single Sign-On**, for Keycloak, Okta, Microsoft Entra ID, Auth0, Ping Identity or any other OpenID Connect provider. Both can read a groups claim from the token and turn it into a Pyn role.

![Connect single sign-on: choose the Provider, then enter the issuer, client ID, client secret and groups claim.](https://support.pynhq.com/media/integrations/sso/integrations-sso-connect.png)

## What you can do here

- [Connect Okta](https://support.pynhq.com/integrations/sso/connect-okta/) with an issuer, client ID and client secret
- [Connect an OpenID Connect provider](https://support.pynhq.com/integrations/sso/connect-an-oidc-provider/), including Keycloak by server URL and realm
- Map groups to roles so your provider decides who is an owner, admin, power user or user
- Share the **Sign-in link** the integration panel shows, or let people use **Continue with SSO** on the sign-in page

## How roles are mapped

Each integration has four lists: **Owner groups**, **Admin groups**, **Power user groups** and **User groups**, each a comma-separated set of group names from your provider's groups claim. The panel explains the rule: "The most privileged match wins. Once any of these is set, the provider decides roles on every sign-in — someone who matches nothing drops to User — so map the group your owners are in before you fill the rest." With no mappings set, roles are managed in [Users](https://support.pynhq.com/settings/users/) as usual.

Pyn does not create users ahead of time from your provider. A person who signs in through SSO for the first time is created then, with the role their groups map to; otherwise invite them first.

## What employees see

The sign-in page offers **Continue with SSO**. The person enters their work email and the page explains "Enter your work email address and you will be taken to your organisation's single sign-on provider." They sign in there and land in Pyn. Opening the **Sign-in link** from the integration panel does the same without the email step. A session lasts 24 hours.

## Where it is in the app

Open `/settings/integrations/available` in Pyn and select the **Okta** or **Single Sign-On** tile. Both appear only in workspaces where Pyn has enabled them; ask support@pynhq.com to switch one on.

## Related

- [Connect Okta](https://support.pynhq.com/integrations/sso/connect-okta/) for the Okta steps.
- [Connect an OpenID Connect provider](https://support.pynhq.com/integrations/sso/connect-an-oidc-provider/) for every other provider.
- [Users](https://support.pynhq.com/settings/users/) for what each role can do.
- [Sign in](https://support.pynhq.com/account/sign-in/) for the other sign-in methods.

## Related Intercom articles

- [Enabling Single Sign On (Pyn 2)](https://intercom.help/pyn/en/articles/16838066-enabling-single-sign-on-pyn-2) — replaces
- [Connect to Okta SSO (Pyn 2)](https://intercom.help/pyn/en/articles/16838252-connect-to-okta-sso-pyn-2)
- [Connect to Okta SSO](https://intercom.help/pyn/en/articles/6002159-connect-to-okta-sso) — Pyn 1 article, kept for reference
- [Connect to Okta API](https://intercom.help/pyn/en/articles/9421970-connect-to-okta-api) — Pyn 1 article, kept for reference