---
title: "Enterprise SSO"
description: "Let your team sign in to ThunderPhone through your company identity provider, with just-in-time provisioning and an organization-wide security policy you control."
---

Enterprise SSO lives on **Settings → Organization** (General tab), in
the **Enterprise SSO** card. Flip the **Single sign-on** switch to
reveal the configuration. Only organization **admins** and **owners**
can see or change these settings.

## Security policy

Three org-wide switches, saved together with **Save Policy**:

- **Require SSO for sign-in** — members must authenticate through your
  identity provider.
- **Allow break-glass password sign-in for admins** — an emergency
  password path for admins while SSO is enforced (only configurable
  when enforcement is on).
- **Require passkeys for organization access** — every member must
  register a [passkey](/guides/account-and-security) and pass a
  post-login passkey check. Members without one get a **3-day grace
  period** to set it up; the policy panel shows how many members still
  need one.

<Note>
  **Org [API keys](/guides/api-keys) are exempt from this requirement.**
  Passkeys are a human 2FA check tied to a login session; server API
  keys (`sk_live_...`) are machine credentials with no session to attach
  a passkey check to, so they keep authenticating even when this policy
  is on — by design, not by omission. When the requirement is enabled
  and your organization has active API keys, the policy panel shows how
  many are exempt, with a link to **Organization → Keys** so admins can
  audit or revoke any that shouldn't still be active.
</Note>

## SSO connections

ThunderPhone's SSO is backed by Stytch. **Add connection** creates one
with:

| Field | What it does |
| --- | --- |
| **Connection name** | A label, e.g. "Acme Workspace SSO". |
| **Default role for new users** | Member, Admin, or Owner for accounts created via SSO. |
| **Stytch organization slug / ID** | Identifies your Stytch organization backing the connection. |
| **Allowed email domains** | Comma-separated domains permitted to sign in through it. |
| **Group-to-role mappings** | JSON array mapping IdP groups to roles, e.g. `[{"group":"it-admins","role":"admin"}]`. |
| **Enable JIT provisioning** | Auto-create ThunderPhone accounts on first SSO sign-in. |
| **Connection active** | Deactivate without deleting. |

Deleting a connection removes it permanently — users who signed in
through it can no longer use it.

<Note>
  Setting up the identity-provider side requires a Stytch organization;
  if you don't have those identifiers, contact
  [support](mailto:support@thunderphone.com) to get your organization
  provisioned.
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Invite your team" icon="user-plus" href="/guides/invite-your-team">
    Roles and invitations for members joining outside SSO.
  </Card>
  <Card title="Account & security" icon="shield" href="/guides/account-and-security">
    What the passkey requirement looks like for each member.
  </Card>
</CardGroup>