Single sign-on (SAML & OIDC)
Let members sign in to Sleak with Google, Microsoft or your own identity provider through SAML.
Open Settings → Security → Sign-in methods to set up Microsoft or connect a SAML identity provider. Owners and Admins can configure these connections. Sleak configures Google sign-in.
Choose a method
| Option | Protocol | Setup |
|---|---|---|
| Microsoft Entra | OIDC | Follow Microsoft Entra ID setup. |
| SAML 2.0 | SAML | Connect and test your identity provider as described below. |
| OIDC | Contact Sleak. The card shows Via support. |
Connect SAML
You need a verified email domain and access to your identity provider's settings. Your own email domain must be verified for the sign-in test.
- Verify a domain under Security.
- Click Set up next to SAML 2.0.
- Create a SAML app for Sleak in your identity provider.
- Enter the Entity ID shown by Sleak in that app.
- Enter the ACS URL shown by Sleak.
- Map the claims shown under Claims:
emailandname. The optionallocaleclaim sets the member's language. - Paste the metadata URL under Connect, or use Upload XML file.
- Click Connect if you entered a URL.
- Click Sign in with SAML to test the connection.
A metadata URL lets Sleak load new certificates automatically. Use XML if your provider has no public metadata URL. The current setup screen connects and tests SAML. Contact Sleak to complete the workspace switch.
Your own account uses SAML after the test. Contact support if a domain or provider is already connected to another workspace.
What changes for members
| Sign-in method | Account behaviour |
|---|---|
| SAML | The first SAML sign-in migrates an existing password or magic-link account, including conversations, licenses, teams and settings. The domain must be verified in the workspace. |
| Google or Microsoft | The verified email address links the existing account. Account data stays in place. |
Members with verified domains use the workspace's active sign-in method. They no longer receive magic links once SAML is active. Allow external sign-in controls access for other email domains. See Security settings.
Combine with SCIM
SSO controls how members sign in. SCIM creates, updates and removes workspace members. You can use either separately or both together.
Related articles
Last updated on 14 November 2026
Security settings
Verify your email domains, decide how colleagues join and how they sign in, set up Microsoft Entra ID, connect your identity provider through SCIM, and test whether your network allows live voice conversations.
User provisioning (SCIM)
Let Microsoft Entra ID, Okta or another identity provider create, update and remove the members of your workspace through SCIM.