# Single Sign-On

Connect your identity provider so members sign in with your company account. ContextOwl supports OIDC with Google and Microsoft Entra, configured per organization.

## Configure a provider

1. Open **Admin > Settings > Security**.
2. In the **SINGLE SIGN-ON** card, choose **GOOGLE** or **MICROSOFT**.
3. Enter the **CLIENT ID** and **CLIENT SECRET** from your provider.
4. For Microsoft, set **MICROSOFT TENANT** to common, organizations, or your tenant id.
5. Add your **ALLOWED EMAIL DOMAINS**, such as acme.com.
6. Pick a **DEFAULT ROLE FOR NEW USERS**.
7. Select **SAVE SSO**.

Client secrets are encrypted at rest.

## Verify your domains

Enforcement and automatic account creation only apply to verified domains. ContextOwl shows a DNS TXT value under **DOMAIN OWNERSHIP**:

```text
cowl-domain-verify=<token>
```

Add it as a TXT record at your DNS provider, then select **VERIFY**.

## Provisioning and enforcement

- **Just-in-time provisioning**: create accounts automatically on first SSO login, using the default role.
- **Enforce SSO**: block password sign-in for your verified domains so members must use the identity provider.

To turn SSO off, select **DISCONNECT**.

## Plan

SSO is a paid feature. If **SAVE SSO** is disabled, upgrade your plan from **Admin > Plan**.