> ## Documentation Index
> Fetch the complete documentation index at: https://radarhq.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO (SAML / OIDC)

> Self-serve SAML and OIDC setup via the WorkOS Admin Portal. Owner-only. Once configured, users in your IdP authenticate without going through email magic-link.

Radar Cloud uses [WorkOS](https://workos.com) for SSO. Owners configure their IdP self-serve via the WorkOS Admin Portal - Okta, Azure AD, Google, OneLogin, generic SAML, generic OIDC. On save, WorkOS provisions the connection and notifies the Radar Cloud control plane.

## Set up SSO

**Settings → Organization → SSO** (owner-only). Click **Set up SSO**:

1. Radar lazy-creates a WorkOS organization for you (one per Cloud org) and opens the WorkOS Admin Portal in a new tab.
2. Pick your IdP from the menu. WorkOS will walk you through the IdP-specific steps:
   * For SAML: SAML metadata URL or XML upload, attribute mapping.
   * For OIDC: discovery URL, client ID / secret.
   * For named IdPs (Okta, Azure AD): OAuth-style consent flow that handles the rest.
3. Save. WorkOS sends a webhook back to the control plane. Once verified, the **SSO** card flips to **Connected** and shows the IdP name + last-tested timestamp.

After setup, users from your IdP can sign in via **app.radarhq.io/login → "Sign in with SSO"** (or whatever the SAML / OIDC discovery flow auto-detects from their domain). New SSO users land in your org with the **Default invite role** if your domain is allowed; otherwise, an owner needs to invite them explicitly.

## Domain matching

WorkOS routes SSO sign-ins by email domain. The **Verified email domain** under **Settings → Organization → SSO** must match the domain your IdP issues identities for. If you have multiple verified domains, list them all in **Allowed email domains** under [Members](/docs/cloud/members).

## What about JIT / SCIM provisioning?

* **JIT (just-in-time provisioning)** - works today. The first time a user signs in via SSO, they're created as a Cloud user. If domain auto-join is configured, they also land in the org with the default role.
* **SCIM** - directory-based user / group sync. Not yet shipped. The schema is reserved on our side but the provisioning endpoints aren't live. Track this on the changelog if you need it for compliance.

## Disconnecting SSO

Owners can manage the connection through the WorkOS Admin Portal (the same link the SSO card opens). Removing the connection there stops new SSO sign-ins; existing sessions remain valid until cookie expiry.

There's no "force every user out" button today - if you need to immediately revoke access for someone whose IdP user was disabled, also remove them from **Settings → Organization → Members**, which cuts their server-side session.

## Audit

SSO setup, IdP changes, and SSO sign-ins all show up in the [audit log](/docs/cloud/audit-log) with action `auth.sso.*`. The IdP name and connection ID appear in the metadata.

## Free vs. paid

SSO is available on every plan, including Free.

## See also

* [Organizations & roles](/docs/cloud/organizations).
* [Members & invitations](/docs/cloud/members) - including domain auto-join.
* [Audit log](/docs/cloud/audit-log).