Configure SSO
Available on: Growth and Enterprise. Configured in a web browser at admin.wisprflow.ai. SSO sign-in works on Mac, Windows, iOS, and Android.
Let your team sign in to Wispr Flow with your company's identity provider. Admins set up SAML single sign-on (SSO) in the Admin Portal and can optionally require everyone to use it.
Before you start
Identity provider: Access to your identity provider — such as Okta, Microsoft Entra ID (Azure AD), or Google Workspace — with permission to create a SAML application.
Role: Admin on Growth; Admin, IT Admin, or Super Admin on Enterprise. Members cannot configure SSO. See Admin Portal roles and permissions.
Plan: SAML SSO is included on Growth and Enterprise. Pro and legacy Team plans do not include it.
Domains: Attaching multiple email domains and auto-add by domain work on both plans without DNS verification. Domain capture — enforcing organization membership for everyone on your domain, including people with existing personal accounts — is a separate Enterprise capability; contact support, who runs DNS verification.
How to configure SSO
Tip: You don't need to paste XML metadata or certificates — use the prompts and links in the setup portal.
Open admin.wisprflow.ai and sign in with a Wispr Flow admin account.
Go to Settings → Organization → User management and find SSO / SAML Authentication.
Click Configure SSO, then follow the setup portal's prompts in the new tab to select your identity provider.
Create a Wispr Flow SAML application in your identity provider, using the ACS URL, entity ID, and other values the setup portal provides.
Assign the users or groups that should have access to Wispr Flow.
Complete test authentication, if prompted, with an account that exists in your identity provider and has access to the Wispr Flow SAML app.
Return to Settings → Organization → User management and click Refresh. A successful check shows “Single sign-on is active.”
The button label shows the state: Configure SSO means not set up, Finish setup means inactive, and Manage SSO means connected. The provider name is not displayed.
If the connection isn't active
An inactive connection shows “SSO setup is in progress. Finish setup to activate single sign-on.” A failed check can show “Unable to connect to your SSO provider. Check your SSO configuration and try again.”
Complete remaining setup-portal steps through Finish setup, if shown.
Check that the connection is associated with your organization and its attached domains.
Click Refresh again; Manage SSO confirms activation.
If test authentication fails during setup
Wait a few minutes for a new or updated SAML app to take effect, confirm the test user is assigned to the Wispr Flow SAML app, then click the sign-in button to retry.
If you deleted or replaced your SSO connection
Reconnect, or click Refresh in Settings → Organization → User management. This drops the old connection and points sign-ins at your new one; Manage SSO and “Single sign-on is active” confirm the change took effect.
If a member's sign-in is rejected
Members see an error page explaining why sign-in didn't work — for example, that SSO isn't configured, or that they were not invited to the organization. The “not invited” page appears whenever the person's email domain isn't allowed for your organization, whether they used SSO, Google, Apple, or Microsoft.
Invite the member or attach their email domain to your organization, then ask them to sign in again. When sign-in started in a web browser, the page includes a Back to login button so they can try another account.
If a member is asked to verify their email
This isn't a rejection. After choosing SSO, Google, Apple, or Microsoft, a member may land on a Check your email page and need to enter the 6-digit code sent to their mailbox. They can request a new code after 30 seconds (sometimes longer) and have up to five attempts; the code expires 5 minutes after they choose their provider.
Once verified, an Email verified page returns them to the desktop app, mobile app, or website they started from, signed in to the same account and team. If the code expires or the page asks them to start over, have them begin sign-in again from the original app or page.
Optional: enforce SSO
Enforcement is off by default; connected SSO works without it. Enforce SSO for all members appears to admins only after SSO connects.
Warning: Enforcement blocks non-SSO sign-in (email and password, Google, Apple, and Microsoft) and new email-and-password sign-ups on the enforced domain. Existing users must switch to SSO.
Go to Settings → Organization → User management.
Enable Enforce SSO for all members.
Tell members they will sign in through your identity provider instead of email and password.
Enforcement and domain-access restrictions apply at sign-in only while your subscription is active, in trial, or past due; outside those states neither restriction blocks sign-in, though the setting stays on and is checked at each sign-in. Neither restriction ever blocks you from changing the setting, and sign-in is allowed if a restriction check can't be completed. If your subscription is canceled, contact support to confirm how enforcement behaves and whether it must be re-enabled when the subscription is restored.
Note: Configure SCIM (Enterprise only) stays disabled until SSO is connected and active. Directory sync blocks self-signup and email-code sign-in independently of SSO enforcement and billing, and membership comes from the directory rather than domain auto-add. See Set up SCIM user provisioning.
Still need help?
Contact support if:
Setup reports “This domain is already linked to another organization. Contact support.”
Test authentication still fails after you've waited and verified the SAML app configuration.
Your identity provider isn't covered by the setup portal, or you need to migrate providers or run multiple SSO connections.
Members see repeated SSO errors or unexpected redirects.
Include your platform, identity provider name, and the steps you've already tried.
Need a hand?
Reach the Flow team and we’ll help you get unblocked.