Configure SSO

Last updated: October 29, 2026

Available on: Web admin setup for Growth and Enterprise business subscriptions. SSO sign-in works on Mac, Windows, iOS, and Android.

Set up SAML single sign-on (SSO) so your team can sign in to Wispr Flow with your company's identity provider. Admins can optionally require everyone to use SSO.

Before you start

  • Identity provider: Access to your identity provider — such as Okta, Microsoft Entra ID (Azure AD), or Google Workspace — with permission to create a SAML application.

  • Role: Admin, IT Admin, or Super Admin. Members cannot configure SSO or see the SSO section. See Admin Portal roles and permissions.

  • Plan: On Pro and legacy Team plans, SSO / SAML Authentication is disabled with the tooltip “Upgrade to Enterprise plan to use this feature”.

  • Domains: Only verified domains are shared during SSO setup, so link and verify your domains with a DNS TXT record first — see Add organization domains and finish SSO setup. If your organization is already linked for SSO but has no verified domains, setup reuses that organization link.

How to configure SSO

  1. Open admin.wisprflow.ai and sign in with a Wispr Flow admin account.

  2. Go to Settings → Organization → User management → SSO / SAML Authentication.

  3. Click Configure SSO, then follow the setup portal's prompts in the new tab to select your identity provider.

  4. Create a Wispr Flow SAML application in your identity provider, using the ACS URL, entity ID, and other values the setup portal provides.

  5. Assign the users or groups that should have access to Wispr Flow.

  6. Complete test authentication, if prompted, with an identity-provider account that has access to the Wispr Flow SAML app.

  7. Return to Settings → Organization → User management and click Refresh.

“Single sign-on is active.” and Manage SSO confirm activation. Finish setup means the connection is inactive; Configure SSO means it isn't set up. The provider name isn't displayed.

If setup or activation fails

An inactive connection shows “SSO setup is in progress. Finish setup to activate single sign-on.” A failed check can show “Unable to connect to your SSO provider. Check your SSO configuration and try again.”

  1. Retry the setup button if you see “Failed to set up SSO. Please try again.”

  2. Complete remaining setup-portal steps through Finish setup, if shown.

  3. Check that the connection is associated with your organization and its attached domains.

  4. Click Refresh again, then look for the activation confirmation above.

After deleting or replacing an SSO connection, reconnect or click Refresh to direct sign-ins to an active replacement matching your organization and domains.

If test authentication fails during setup

Retry test authentication after these checks:

  1. Wait a few minutes for a new or updated SAML app to take effect.

  2. Confirm the test user is assigned to the Wispr Flow SAML app.

  3. Click the sign-in button to retry.

Optional: enforce SSO

Enforcement is off by default; connected SSO works without it. Enforce SSO for all members appears to admins only after SSO connects, and changing it requires an active Flow Business subscription.

Warning: Enforcement blocks non-SSO sign-in (email and password, Google, Apple, and Microsoft) and new email-and-password sign-ups on the enforced domain. Existing users must switch to SSO.

  1. Go to Settings → Organization → User management.

  2. Enable Enforce SSO for all members.

  3. Tell members they will sign in through your identity provider instead of email and password.

Changes are recorded in the organization audit log as access-restriction changes. A rejected non-SSO attempt can show “SSO Sign In Required”; use SSO instead.

Enforcement and domain-access restrictions are checked at each sign-in, and block sign-in only while your subscription is active, in trial, or past due. Outside those states the settings remain unchanged but don't block sign-in, and sign-in is allowed if a restriction check can't be completed. Eligible admins can always change these settings. If your subscription is canceled, contact support to confirm how enforcement behaves and whether it must be re-enabled when the subscription is restored.

Directory sync (SCIM)

Configure SCIM stays disabled until SSO is connected and active, with the tooltip “Connect and activate SSO to enable SCIM provisioning.” Directory sync blocks self-signup and email-code sign-in independently of SSO enforcement and billing, and membership comes from the directory rather than domain auto-add. See Set up SCIM user provisioning.

Warning: Directory sync discards pending invitations. Manage users through your identity provider: the Admin Portal cannot invite or bulk-invite users, revoke invitations, remove members, or accept join requests. Members who see “Account Managed by Your Organization” must contact their IT administrator for access.

Help members finish sign-in

If a member's sign-in is rejected

The error identifies the next action:

  • “Your Organization Has Not Configured SSO”: Flow couldn't connect automatically; finish or check the SSO setup above.

  • “SSO Requires Being A Part Of An Organization”: The email domain isn't associated with an organization.

  • “You were not invited to this organization”: Some SSO, Google, Apple, or Microsoft sign-in flows show this when the domain belongs to your organization, access is restricted to members, and the person remains outside it after automatic joining or invitation acceptance. The billing and check exceptions under enforcement apply.

For a membership rejection without directory sync: invite the member or attach their email domain to your organization, then ask them to sign in again.

Back to login returns to the Wispr website where sign-in started, allowing another account. It is absent when there is no recognized Wispr website to return to, including app-started sign-ins.

If a member is asked to verify their email

After choosing SSO, Google, Apple, or Microsoft, a member may see Check your email. This continues sign-in; it isn't a rejection. These limits apply to that browser page, not in-app email-code screens.

  1. Enter the latest 6-digit code in the same browser, profile, and device used to start sign-in.

  2. Select Verify and sign in.

The code expires five minutes after authentication with the provider, when verification is requested; resending doesn't extend that deadline. Members have up to five attempts.

Check spam for a missing email. A new code can be requested after 30 seconds, sometimes longer, and resend isn't shown while less than that waiting period remains. If “Please wait before requesting another code.” appears, the wait is at least 60 seconds. “A new code has been sent.” confirms a resend; always use the latest code. If “A new code cannot be sent.” appears, use the latest code or restart sign-in from the original app or page.

Expiry, five failed attempts, or switching browsers, profiles, or devices requires starting sign-in again from the original app or page. Exhausting attempts ends that sign-in immediately, without further resends or a lockout timer. If Sign-in unavailable offers Try again, retry within the original five-minute window instead.

Returning to Flow after sign-in

After email verification, sign-ins that started on a Wispr website return to that site, signed in to the same account. App-started sign-ins instead show Log in as <email>; select Open Wispr Flow to return to the app — it doesn't open automatically.

If the app doesn't open, the page reveals download and Admin Portal links. Log in with another SSO account restarts SSO sign-in.

Still need help?

Contact support if:

  • Your domain is already linked to another organization.

  • Test authentication still fails after you've waited and verified the SAML app configuration.

  • Your identity provider isn't covered by the setup portal, or you need to migrate providers or run multiple SSO connections.

  • Members see repeated SSO errors or unexpected redirects.

Include your platform, identity provider name, and the steps you've already tried.