Skip to main content

Documentation index: llms.txt. This page is also available as markdown: append .md to this URL or send Accept: text/markdown.

Single Sign-On

Learn how to enable Single Sign-On for your organization.

Organization-Level SSO

You can now set up SSO yourself with a single connection from Organization Settings > Single Sign-On. See Set Up Organization-Level SSO. The provider-specific guides in this section cover the legacy SSO setup, which stops working on December 15, 2026.

Important Single Sign-on Information​

  • Multi-org support: SSO users who belong to multiple organizations can sign in to each organization, and can choose which organization to access with the same login.
  • Single Sign-On users with username and password: Users that have been configured directly in Coalesce will be able to login with a username/password even if SSO has been enabled so long as their Coalesce-native user record remains active. If you do not wish to allow username/password-based authentication, you will need to disable or delete the users. Leave one break-glass administrator active so you can still sign in if your identity provider is unavailable.
  • Provisioned SSO users: Single Sign-On (SSO) provisioned users are created just in time, when the user initiates their initial login to Coalesce via your SSO provider. Users are not pre-provisioned prior to initial login. New SSO users are created with the lowest permissions: the Org Member role and no access to any Projects. An Org Admin assigns their roles after they first sign in.
  • Multiple records for the same person: While email is used as the unique username for a user within Coalesce, a single email may end up with multiple active user records, each with a unique User ID, within a given Coalesce account. This occurs when a user has been manually created by an admin in Coalesce, as well as provisioned using your single sign-on (SSO) provider. Review Manage Users to see instructions on disabling or deleting extra users.

Removing SSO​

You can't remove an SSO connection yourself. To remove one, contact Coalesce Support. To change a connection's settings instead, see Reconfigure a Connection. Removing or changing a connection can lock users out, so keep a break-glass administrator who can sign in with an email address and password.

If your organization is moving from legacy SSO, you can turn off the new sign-in experience to go back to your legacy setup until legacy SSO stops working on December 15, 2026. See Moving From Legacy SSO.

Access Tokens and SSO
  • Access tokens function independently of SSO. Disabling a user in your SSO platform such as Okta, does not remove the access token. You'll need to also remove the user directly in Coalesce to remove any tokens attached to that user.
  • Access tokens are regenerated after each login. Previously issued tokens remain valid. Tokens never expire across all environments and projects.

Access tokens are removed when:

  • User is deleted in Coalesce.
  • User is disabled in Coalesce.
  • Password changed in Coalesce.
  • Email address change in Coalesce.
  • Turning Multi-factor Authentication on and off.