Setting up SSO with Span
Last updated: October 27, 2026
Single sign-on (SSO) lets your team sign in to Span through your own identity provider over SAML, managed through Span's identity partner, WorkOS. Span has no passwords: once SSO is on, it replaces the emailed sign-in code and Google sign-in for the email domains it covers.
Why it matters
For IT and security: sign-in follows your identity provider's policies, and someone you remove there can no longer sign in to Span.
For your team: people sign in with the same identity they use for other work tools.
How it works
Span routes by email domain. On the Span sign-in page, a person enters their email. If the domain is registered to your organization and your SSO connection is active, Span sends them to your identity provider. Span no longer offers them the emailed sign-in code, and Continue with Google sends them to your identity provider too.
Span holds your domain list. Your organization can have more than one email domain. Span keeps the list, so ask your Span account team to add or remove a domain.
Other domains are unaffected. People whose email is on a domain that isn't registered to your organization, such as contractors, keep signing in with the emailed code or Google.
SSO checks who someone is, not whether they have access. A person still needs a Span account in your organization (Access Type set to Account in People Management). SCIM can grant and remove that access for you from your identity provider.
Span matches by email address. Span looks up the account using the email your identity provider sends. That email must match the person's email in Span. Span reads only the email address from the sign-in, so names and other details in Span don't change when someone signs in.
One connection per organization. Span supports a single SSO connection for each organization.
Setting up SSO
Before you start
Ask your Span account team to confirm your organization's email domains in Span. Once SSO is active, everyone on those domains must sign in through your identity provider. If no domain is registered yet, the Single Sign-On page shows "SSO setup requires at least one configured organization domain."
You need the Manage Integrations permission. Owners, Admins, and Integration Admins have it by default.
If your IT admin doesn't have a Span account, send your Span account team your email domain and the IT admin's email address. Span sends the IT admin a secure link to the same setup portal. The email comes from WorkOS on Span's behalf.
Steps
In Span, go to Settings → Single Sign-On (under Organization).
Click Start setup. This opens the WorkOS setup portal in the same tab.
Choose your identity provider and follow the portal's steps. The portal shows the values to copy into your identity provider, such as the ACS URL and SP Entity ID, and asks for your identity provider's details, such as its metadata.
In the portal, verify the email domains the connection covers. When you finish, the portal returns you to the Single Sign-On page in Span.
Complete a test sign-in. Until a sign-in succeeds, the Single Sign-On page shows Validating: "Waiting for a successful sign-in before it becomes active."
When the page shows Setup complete ("Your organization has an active SSO connection."), SSO is on for your domains. Let your Span account team know so they can confirm.
Setup statuses
Status | What it means |
|---|---|
Not configured | No setup has started. Click Start setup. |
Pending setup | Setup started but no connection exists yet. Click Continue setup. |
Validating | The connection exists and is waiting for a successful sign-in. |
Setup complete | The connection is active and Span sends your domains to your identity provider. |
Inactive | A connection exists but is not active. Click Continue setup or contact Span. |
Unavailable | Span can't show the status right now, or your organization has no registered domain. |
The Connections list on the same page shows the connection type, its state, and the domains it covers.
Things to know
SSO turns on for everyone on your domains at once. As soon as the connection is active, people on your registered domains can no longer use the emailed sign-in code. Plan the switch with your team.
Changing or switching identity providers goes through Span. Once SSO is active, the setup button reads Setup complete and can't reopen the portal. Contact your Span account team to change the connection or move to a different identity provider.
Email mismatches block sign-in. If your identity provider sends an address that differs from the one in Span (for example, an alias), sign-in fails with "Account does not exist." Make the email in Span match the identity provider.
SSO and SCIM are separate. SSO controls how people sign in. SCIM controls who has access. You can set up either one on its own.
Worked example: your organization registers two domains, example.com and example.co.uk, and turns on SSO. Alex (alex@example.com) and Sam (sam@example.co.uk) both go to your identity provider. Jordan, a contractor with jordan@agency.io and a Span account in your organization, still gets an emailed sign-in code.
Related articles
How do I add a new user to Span? (in the customer library)
Roles & Permissions in Span (in the customer library)
Need help?
Contact your Span account team or reach out to support@span.app.