Configure SSO

Last updated: November 13, 2026

Available on: Web admin setup for Growth and Enterprise business subscriptions. SSO sign-in works on Mac, Windows, iOS, and Android.

Set up SAML single sign-on (SSO) so your team signs in to Wispr Flow with your company's identity provider. Admins can optionally require everyone to use SSO.

Before you start

  • Identity provider: Access to your identity provider — such as Okta, Microsoft Entra ID (Azure AD), or Google Workspace — with permission to create a SAML application.

  • Role: Admin, IT Admin, or Super Admin. Members cannot configure SSO or see the SSO section. See Admin Portal roles and permissions.

  • Plan: On Pro and legacy Team plans, the SSO / SAML authentication row shows an Enterprise badge and a disabled Configure SSO button.

  • Domains: Only verified domains are shared during setup, so link and verify your domains with a DNS TXT record first. If your organization is already linked for SSO but has no verified domains, setup reuses that organization link.

How to configure SSO

  1. Open admin.wisprflow.ai and sign in with a Wispr Flow admin account.

  2. Go to Settings → Organization → User management → SSO / SAML authentication.

  3. Click Configure SSO, then follow the setup portal's prompts in the new tab to select your identity provider.

  4. Create a Wispr Flow SAML application in your identity provider, using the ACS URL, entity ID, and other values the setup portal provides.

  5. Assign the users or groups that should have access to Wispr Flow.

  6. Complete test authentication, if prompted, with an identity-provider account that has access to the Wispr Flow SAML app.

  7. Return to Settings → Organization → User management and click the refresh icon next to the SSO button.

“Single sign-on is active.” and Manage SSO confirm activation. Finish setup means the connection is inactive; Configure SSO means it isn't set up. The provider name isn't displayed.

Note: The Admin Portal checks the connection once each time the page loads, so the button may already read Finish setup or Manage SSO before you refresh.

If setup or activation fails

Status appears as an icon beside the SSO / SAML authentication label; point at it or move keyboard focus to it to read the message. An inactive connection shows “SSO setup is in progress. Finish setup to activate single sign-on.” A failed check can show “Unable to connect to your SSO provider. Check your SSO configuration and try again.”

  1. Retry the setup button if you see “Failed to set up SSO. Please try again.”

  2. Complete remaining setup-portal steps through Finish setup, if shown.

  3. Check that the connection is associated with your organization and its attached domains.

  4. Click the refresh icon again, then look for the activation confirmation above.

After deleting or replacing an SSO connection, reconnect or click the refresh icon to direct sign-ins to an active replacement matching your organization and domains.

If test authentication fails during setup

Retry test authentication after these checks:

  1. Wait a few minutes for a new or updated SAML app to take effect.

  2. Confirm the test user is assigned to the Wispr Flow SAML app.

  3. Click the sign-in button to retry.

Optional: enforce SSO

Enforcement is off by default; connected SSO works without it. Enforce SSO for all members appears below SCIM provisioning, to admins only after SSO connects, and changing it requires an active Flow Business subscription.

Warning: Enforcement blocks non-SSO sign-in (email and password, Google, Apple, and Microsoft) and new email-and-password sign-ups on the enforced domain. Existing users must switch to SSO.

  1. Go to Settings → Organization → User management.

  2. Enable Enforce SSO for all members.

  3. Tell members they will sign in through your identity provider instead of email and password.

Changes are recorded in the organization audit log as access-restriction changes. A rejected non-SSO attempt can show “SSO Sign In Required”; use SSO instead.

Enforcement and domain-access restrictions are checked at each sign-in, and block sign-in only while your subscription is active, in trial, or past due. Outside those states the settings remain unchanged but don't block sign-in, and sign-in is allowed if a restriction check can't be completed. Eligible admins can always change these settings. If your subscription is canceled, contact support to confirm how enforcement behaves and whether it must be re-enabled when the subscription is restored.

Directory sync (SCIM provisioning)

Configure SCIM stays disabled until SSO is connected and active, with the tooltip “Connect and activate SSO to enable SCIM provisioning.” Directory sync blocks self-signup and email-code sign-in independently of SSO enforcement and billing, and membership comes from the directory rather than domain auto-add. See Set up SCIM user provisioning.

Warning: Directory sync discards pending invitations. Manage users through your identity provider: the Admin Portal cannot invite or bulk-invite users, revoke invitations, remove members, or accept join requests. Members who see “Account Managed by Your Organization” must contact their IT administrator for access.

If a member's sign-in is rejected

Membership is applied as someone signs in, whichever method they use: a pending invitation for that email is accepted automatically, and people on a domain attached to your organization become members at that moment, with any seat change on your subscription applied then. If sign-in is still rejected, the error identifies the next action:

  • “SSO isn't available for this email. Try another sign-in method, or contact your administrator if your company uses SSO.”: No SSO is configured for that email's domain. On Android, members see this as soon as they enter the email. Finish or check the SSO setup above, or have them sign in another way.

  • “Your Organization Has Not Configured SSO”: Flow couldn't connect automatically; finish or check the SSO setup above.

  • “SSO Requires Being A Part Of An Organization”: The email domain isn't associated with an organization.

  • “You were not invited to this organization”: Shown on SSO, Google, Apple, and Microsoft sign-in when the domain belongs to your organization, access is restricted to members, and the person is still not a member after automatic joining and invitation acceptance. No sign-in is granted. Email-and-password and email-code sign-ins aren't affected by this restriction. The billing and check exceptions under enforcement apply.

For a membership rejection without directory sync: invite the member or attach their email domain to your organization, then ask them to sign in again.

Still need help?

Contact support if:

  • Your domain is already linked to another organization.

  • Test authentication still fails after you've waited and verified the SAML app configuration.

  • Your identity provider isn't covered by the setup portal, or you need to migrate providers or run multiple SSO connections.

  • Members see repeated SSO errors or unexpected redirects.

Include your platform, identity provider name, and the steps you've already tried.