# Set up single sign-on (SSO)

On the **Business** plan, your team can sign in to Relaypoint with your company's identity provider over SAML 2.0.

:::steps
### Create an app in your identity provider

Add a new SAML application and use these values:

| Field          | Value                                                 |
| -------------- | ----------------------------------------------------- |
| ACS URL        | `https://app.relaypoint.example/sso/acme-support/acs` |
| Entity ID      | `https://app.relaypoint.example/sso/acme-support`     |
| Name ID format | Email address                                         |

### Copy the metadata URL

Your identity provider shows a metadata URL once the app is saved. Copy it.

### Connect it in Relaypoint

Go to **Settings › Security › Single sign-on**, paste the metadata URL and select **Test connection**.

### Turn on enforcement

Once the test succeeds, choose **Require SSO** so passwords can no longer be used.
:::

:::danger Keep a way back in
Before you require SSO, make sure at least one Owner can still sign in. If your identity provider goes down, an Owner can use a one-time recovery code from **Settings › Security**.
:::

:::details Which attributes do you read?
Relaypoint reads `email` (required), `firstName` and `lastName`. Group attributes can map people to teams; ask support to turn that on.
:::