---
title: "Set up an SSO connection | Lansweeper Platform"
slug: "set-up-an-sso-connection"
description: "Set up single sign-on for your Lansweeper account with SAML or OIDC, so users can log in through your identity provider instead of a password."
updated: 2026-08-13T10:07:58Z
published: 2026-08-13T10:07:58Z
canonical: "docs.lansweeper.com/set-up-an-sso-connection"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up an SSO connection

Single sign-on (SSO) lets users log in to Lansweeper with the credentials from your identity provider (IdP), instead of a separate Lansweeper password. Lansweeper supports SAML and OIDC connections.

An SSO connection belongs to your Lansweeper account, not to a single site. Once you verify a domain for the connection, every user with an email address on that domain can use SSO to log in to any site they have access to.

## Prerequisites

- Administrator access to your identity provider (IdP).
- Ownership of the domain you want to add to the connection. You need to add a DNS TXT record to verify it.

<!-- VERIFY: confirm which Lansweeper account role (for example, account owner) is required to create an SSO connection. -->

## Create an SSO connection

1. Go to **Account settings > Single Sign-On**.
2. Select **Create SSO connection**.
3. Choose a connection type: **SAML** or **OIDC**. Your identity provider determines which one to use. Most identity providers support at least one.
4. Continue to **Connection setup** and enter a **Name** for the connection.

<!-- SCREENSHOT: The Single Sign-On page in Account settings, showing the Create SSO connection button -->

<!-- SCREENSHOT: The Connection type step, showing the SAML and OIDC options -->

### Configure a SAML connection

The **Service provider metadata** section is read-only. Copy these values into your IdP's configuration:

- **Entity ID**
- **Assertion Consumer Service (ACS) URL**
- **SingleLogout Service (SLO) URL**
- **IdP Assertion Consumer Service (ACS) URL**: only needed if you enable IdP-initiated SSO.

You can also select **Download SP certificate (PEM)** to give your IdP a certificate it can use to validate signed requests or encrypt assertions from Lansweeper.

<!-- SCREENSHOT: The Service provider metadata section of a SAML connection, showing the Entity ID, ACS URL, SLO URL, and Download SP certificate button -->

In the **Identity provider configuration** section, enter the details from your IdP:

1. Enter the **Sign in URL** from your IdP.
2. Upload your IdP's **X509 signing certificate**, in PEM or CER format.

<!-- SCREENSHOT: The Identity provider configuration section of a SAML connection, showing the Sign in URL field and the X509 signing certificate upload -->

To enable IdP-initiated SSO:

1. Add the **Assertion Consumer Service (ACS) URL** and **IdP Assertion Consumer Service (ACS) URL** from the Service provider metadata section to your IdP.
2. Turn on **Enable IdP-initiated Single Sign-On**.

Optionally, configure:

- **NameID format**: the format Lansweeper includes in the SAML response. Defaults to **Persistent**.
- **Email claim**: the claim Lansweeper uses to read the user's email address. Defaults to `emailaddress`.

:::(Warning) (Your IdP must send a verified email attribute)
Lansweeper requires your IdP to send the user's email address and confirm it's verified. Check your IdP's attribute or claim configuration before you finish setup.
:::

<!-- VERIFY: confirm the exact attribute or claim name Lansweeper expects for "email verified" with the current auth provider. The connection setup screen doesn't show a dedicated field for it. -->

### Configure an OIDC connection

The **Service provider metadata** section is read-only:

- **Callback URL**: configure this in your OIDC provider to complete authentication.

In the **Identity provider configuration** section, enter the details from your IdP:

1. Enter the **Discovery URL** for your OIDC provider. This is typically its `.well-known/openid-configuration` endpoint. Lansweeper uses it to retrieve the rest of the configuration automatically.
2. Enter the **Client ID**.
3. Enter the **Client secret**.

<!-- SCREENSHOT: The Identity provider configuration section of an OIDC connection, showing the Discovery URL, Client ID, and Client secret fields -->

Optionally, configure the **Email claim**: the claim Lansweeper uses to read the user's email address. Defaults to `emailaddress`.

When you're done, save the connection.

<!-- VERIFY: exact label of the button that saves and creates the connection. -->

## Add and verify a domain

Before anyone can log in with SSO, add and verify at least one domain.

1. In the **Single Sign-On** view, select **Add domain**.
2. Enter a domain you own, then select **Add**. Lansweeper adds the domain and shows a code to verify ownership.
3. Add the code as a TXT record with your DNS provider.
4. Once the record is in place, return to the **Single Sign-On** view and select **Verify domain**.

<!-- SCREENSHOT: The Add domain dialog with the domain name field -->

<!-- SCREENSHOT: The Single Sign-On view showing a domain with "Not verified" status and the Verify domain button -->

A verified domain still needs to be enabled before users on that domain can log in with SSO. For that, and for managing domains and connection managers, see [Manage an SSO connection](/docs/manage-an-sso-connection).

## Log in with SSO

Once a domain is verified and enabled, users with an email address on that domain can select **Log in with Single Sign-On** to log in with your IdP's credentials instead of a Lansweeper password.

Password login remains available for these users unless a site requires SSO.

<!-- VERIFY: confirm whether an existing password-login user is prompted to link their account to SSO on first login, or if Lansweeper matches the account automatically by email address. -->

## Next steps

- [Manage an SSO connection](/docs/manage-an-sso-connection)