- Yes, through your identity provider
- Which accounts get it
- The technical checklist for your IT person
- Turning it on
- Rolling it out without locking anyone out
- Owners can bypass it, and logout stays in Slack
- Onboarding once SSO is on
- How Notion and Zapier compare
- My advice for setting it up
- Frequently asked questions
Yes. Slack supports SAML single sign-on through the identity provider of your choice, plus custom SAML for providers without a ready guide. Workspace Owners and Org Owners set it up. Slack lists it for Business+ and Enterprise plans, and for Free and Pro plans if a Salesforce org is connected, as of Nov 2026.
Yes, through your identity provider
SAML-based single sign-on lets members reach Slack through an identity provider, or IDP, of your choice. For a business, that means one login for every tool, and when someone leaves, switching off their account in the IDP closes the door to Slack too.
Slack has setup guides for Auth0, Google Workspace (SAML), JumpCloud, LastPass, Microsoft Entra, Okta, OneLogin, and PingFederate and PingOne. There are also guides for custom SAML SSO, Google Workspace SSO and ADFS SSO, so an IDP without its own guide can still connect.
Which accounts get it
Slack lists the feature for Business+ and Enterprise plans. It's also available on Free and Pro plans if you've connected a Salesforce org to Slack, as of Nov 2026.
The technical checklist for your IT person
- Both IDP-initiated and SP-initiated sign-in flows are supported.
- Just In Time provisioning is supported, and automatic provisioning runs through Slack's SCIM API.
- Slack requires HTTP POST binding, not HTTP REDIRECT.
- The SAML response must be signed with a valid X.509 .pem certificate.
- The NameID and email attributes are required; username, first name and last name are optional.
- Single Logout and session duration set in your IDP aren't supported; set a session duration in Slack instead.
Turning it on
A Workspace Owner enables SSO from Admin, Workspace settings, Security, SSO & authentication. On an Enterprise org, it lives under Tools & settings, Organization settings, Security, SSO Settings.
You can make SSO required for all members, required for all members except guests, or optional. Requiring it for everyone but guests is a common middle ground: staff use the company login, while freelancers and clients keep their own Slack sign-in.
Rolling it out without locking anyone out
The three modes make a staged rollout easy. Start with SSO set to optional, and ask a few people to sign in through the IDP so you can check names and emails map correctly. Once that works, switch to required for all members except guests, and tell the team the day before so nobody's caught out on a Monday morning. Keep at least one owner who can sign in with email and password while you test, in case the IDP side needs a fix.
Owners can bypass it, and logout stays in Slack
The Slack Help Center article on setting up SAML SSO points out two things that matter for security planning. Workspace Owners and Org Owners can bypass SSO and sign in with an email and password. That's deliberate: it keeps access open if the IDP has a problem. But it also means owner accounts need strong passwords and two-factor sign-in of their own.
Second, Slack doesn't honour Single Logout from your IDP. Signing someone out of the IDP won't sign them out of an open Slack session. You control that with Slack's own session duration setting, so pick a length that matches your security policy.
If you're tightening security more widely, this checklist of signs a business takes security seriously is a useful companion, and my Bitwarden and 1Password comparison covers protecting those owner passwords.
Onboarding once SSO is on
With SCIM provisioning in place, new starters can appear in Slack automatically from your IDP. Without it, Just In Time provisioning creates the account the first time someone signs in through SSO. Guests still come in through invitations; this guide on inviting someone to Slack covers that.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
How Notion and Zapier compare
Notion provides SAML SSO for users on its Business or Enterprise Plan. Zapier has a help article on provisioning user accounts with SCIM. For other team chat tools and how they handle sign-in, see my list of Slack alternatives.
My advice for setting it up
Follow the guide for your IDP, check POST binding and a signed response first, and map NameID and email. Set SSO to required for members but not guests. Then set a Slack session duration, since IDP logout won't end sessions, and lock down owner accounts with strong passwords and two-factor sign-in.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Does Slack support SAML?
Yes, SAML 2.0 through an identity provider of your choice.
Which providers have guides?
Auth0, Google Workspace, JumpCloud, LastPass, Microsoft Entra, Okta, OneLogin, and PingFederate and PingOne, plus custom SAML and ADFS.
Can I make SSO optional?
Yes. It can be required for all, required except guests, or optional.
Does Slack support SCIM?
Yes. Automatic provisioning runs through Slack's SCIM API.
Does Slack support Single Logout?
No.
