AdministrationWorkspaces

Single Sign-On (SSO)

Configure SSO to let your team sign in to ElevenLabs using your existing identity provider.

Overview

SSO is available for Enterprise customers only. Only Workspace admins can enable this feature. To upgrade, get in touch with our sales team.

Single Sign-On (SSO) allows your team to sign in to ElevenLabs using your existing identity provider (IdP). ElevenLabs supports SAML 2.0 and OIDC for enterprise SSO, and Service Provider (SP) initiated sign-in.

Before enabling SSO, you must verify your email domain. Workspace members sign in with the same email domain that is verified and associated with your SSO configuration.

Set up SSO

1

Open Security & SSO settings

Go to Workspace settings > Security & SSO.

2

Restrict sign-in methods (optional)

Under Allowed Identity Providers, you can restrict which sign-in methods workspace members may use — for example, limiting sign-in to your enterprise SSO provider only and disabling social providers such as Google, Apple, and GitHub.

By default, all providers are enabled. Changes take effect immediately.

3

Verify your email domain

Under User Auto Provisioning, verify the email domain your users will sign in with. This proves ownership of the domain and is required before you can associate it with an SSO provider.

Add a DNS TXT record to your domain’s DNS settings with the verification code shown, then click Verify. You can also enable auto-provisioning so users with a matching email domain are automatically added to your workspace when they sign up.

4

Configure your SSO provider

Under SSO Provider, select your protocol:

  • SAML — use with Okta, Microsoft Entra, OneLogin, and other SAML 2.0 identity providers.
  • OIDC (OpenID Connect) — use with providers that support OIDC.

Microsoft Entra (formerly Azure AD) is only supported through SAML. Do not use OIDC with Entra — it can cause sign-in failures.

Only SP-initiated SSO is supported for SAML. To simplify sign-in, create a bookmark app in your IdP that links to https://elevenlabs.io/app/sign-in?use_sso=true. You can include the user email as a query parameter to pre-fill it: https://elevenlabs.io/app/sign-in?use_sso=true&email=user@company.com

Fill in the required fields for your provider (entity ID, sign-in URL, certificate), then click Update SSO.

Saving a new SSO provider configuration will immediately log out all workspace members currently signed in with SSO.

5

Add your verified domain

After saving the SSO provider configuration, click Add Domain and select the verified domain that matches your users’ email addresses. Only verified domains appear in this list.

For provider-specific field mappings and screenshots, see the guides below.

Microsoft Entra SAML

Step-by-step setup for Microsoft Entra ID (formerly Azure AD).

Okta SAML

Step-by-step setup for Okta SAML 2.0.

SCIM

SCIM is available for Enterprise workspaces, configurable by Workspace admins.
SCIM

SCIM (System for Cross-domain Identity Management) allows your Identity Provider (IdP) to automatically provision, update, and deprovision users and groups in your ElevenLabs workspace.

FAQ

For Microsoft Entra-specific setup steps, field mappings, and troubleshooting notes, see Microsoft Entra SAML SSO.

For Okta-specific setup steps, field mappings, and troubleshooting notes, see Okta SAML SSO.

In your OneLogin app configuration, set Recipient to:

  • https://elevenlabs.io/__/auth/handler for standard environments
  • https://<region>.residency.elevenlabs.io/__/auth/handler for data residency environments, replacing <region> with your region code.

Set ACS (Consumer) URL Validator to the same value. Set ACS (Consumer) URL to the ElevenLabs Redirect URL shown in your SSO provider settings. Set the SAML Initiator to Service Provider (SP-initiated only).

Ensure that email and email_verified are included in the OIDC response claims. Without these, the following errors may occur:

  • No email address was received — add email to the response.
  • Account exists with different credentials — add email_verified to the response.

Inside the <saml:Subject> field of the SAML response, confirm that <saml:NameID> is set to the user’s email address. See the field mapping guide for your IdP for the correct attribute to use.

No. Only Service Provider (SP) initiated SSO is supported. Users must start sign-in from the ElevenLabs sign-in page (https://elevenlabs.io/app/sign-in?use_sso=true). You can create a bookmark app in your IdP that links there for a smoother experience.