# Single sign-on

Your team signs in to Texa Desk with Microsoft Entra ID, Google Workspace or any SAML 2.0 identity provider, optionally enforced.


An administrator sets it up in Texa Desk under **Settings → Security → Single sign-on**.

| Provider | Protocol |
|---|---|
| Microsoft Entra ID | OpenID Connect, with PKCE, nonce and signature checks |
| Google Workspace | OpenID Connect |
| Any other (Okta, OneLogin, JumpCloud, ADFS…) | SAML 2.0, signed responses to Texa Desk's own requests only |

## Addresses your provider needs

`{account_id}` is your account's number (in Texa Desk's address after `/accounts/`).

| | Address |
|---|---|
| OpenID Connect redirect | `https://desk.texadesk.com/sso/{account_id}/oidc/callback` |
| SAML assertion consumer service (ACS) | `https://desk.texadesk.com/sso/{account_id}/saml/acs` |
| SAML metadata (entity id and certificates) | `https://desk.texadesk.com/sso/{account_id}/saml/metadata` |

For OpenID Connect, give Texa Desk your app's client id and secret (stored encrypted). For SAML,
give your provider's entity id, sign-in URL and signing certificate.

## Your domains

Only your own email domains sign in through your SSO, and each must be proven: by Microsoft or
Google on every sign-in, or, for SAML, by a DNS TXT record Texa Desk shows you. One domain belongs to
one account.

## Optional

- **Provisioning:** people who sign in through your provider for the first time get an account in
  Texa Desk.
- **Enforce SSO:** password and "Sign in with Google" close for your team, except one named
  break-glass administrator, so you're never locked out.

Every SSO sign-in and settings change is in your **audit log**. The Texa Desk app signs in through
your SSO too.