Single sign-on and SCIM

Let members sign in through your identity provider with OIDC or SAML, and provision accounts automatically with SCIM 2.0.

Single sign-on (SSO) lets members sign in to the SipherMail web app with your identity provider. SCIM keeps the member list in step with your directory.

Before you start#

  • You need a verified domain in the organisation. SSO applies to email addresses on the domains you claim.
  • You need the Security admin role, or higher.
  • SSO works in the web app. Mobile apps and mail clients keep using the member’s SipherMail sign-in or app passwords.

Set up OIDC#

  1. Open Org Panel > Single sign-on and choose OIDC.
  2. Copy the redirect URL shown on the page into your identity provider.
  3. Enter the issuer URL, client ID and client secret from your provider.
  4. Choose the domains that use SSO, then choose Test connection.
  5. Turn SSO on.

The client secret is stored encrypted and is never shown again. To change it, enter a new one.

Set up SAML#

  1. Open Org Panel > Single sign-on and choose SAML.
  2. Give your identity provider the entity ID, ACS URL and metadata URL shown on the page.
  3. Paste the identity provider’s sign-in URL, issuer and signing certificate.
  4. Choose the domains that use SSO, test, and turn SSO on.

SipherMail supports sign-in that starts from SipherMail. Sign-in that starts from the identity provider’s own app launcher is refused.

Require SSO#

Require SSO stops password sign-in for the claimed domains. You can turn it on only after an administrator has signed in through SSO once, so you cannot lock yourself out. The organisation Owner keeps a password sign-in as a break-glass route, and each use is recorded in the audit log.

New members#

With Create accounts on first sign-in on, someone who signs in through SSO gets an account and a mailbox in your organisation, using the default role you chose. Seat limits still apply. SipherMail never links an SSO sign-in to an existing account outside your organisation.

SCIM provisioning#

  1. In Single sign-on, open SCIM and create a token. It is shown once.
  2. Give your identity provider the SCIM base URL shown and the token.
  3. Assign people to the SipherMail app in your identity provider.

SCIM supports Users (create, read, update, deactivate). Groups are read-only and list the organisation roles. Setting a user to inactive suspends the member and signs them out. It does not delete their data.

Last updated 1 November 2026