## Single Sign-On (SSO) and SCIM Provisioning

This section provides comprehensive documentation on setting up and managing Single Sign-On (SSO) and SCIM provisioning for your Stripe account. SSO allows your team to access Stripe using a single set of credentials managed by your Identity Provider (IdP), enhancing security and user experience. SCIM provisioning automates the creation and deactivation of user accounts in Stripe based on your IdP's group memberships.

### Core Concepts

*   **Single Sign-On (SSO):** Enables users to authenticate with Stripe through a designated Identity Provider (IdP), eliminating the need for separate Stripe credentials. Stripe supports SAML 2.0, making it compatible with most IdPs.
*   **Identity Provider (IdP):** A service that manages user identities and authenticates users. Popular IdPs supported by Stripe include Entra ID (formerly Azure AD), Google Workspace, Okta, and OneLogin.
*   **SCIM (System for Cross-domain Identity Management):** A standard protocol for automating the exchange of user identity information between identity domains or IT systems. In the context of Stripe, SCIM allows for automatic provisioning and deprovisioning of users based on their group memberships in your IdP.
*   **Group-Based Role Assignment:** A feature that allows you to automatically assign Stripe Dashboard roles to users based on their group membership within your IdP, synchronized through SCIM.

### Setting Up SSO

The process of setting up SSO generally involves the following steps:

1.  **Prove Domain Ownership:** Verify that you own the email domains your team uses to access Stripe.
2.  **Configure Your IdP:** Set up your chosen IdP to work with Stripe. This typically involves creating an application within your IdP for Stripe.
3.  **Configure Stripe:** Configure Stripe to work with your IdP, often by providing information from your IdP's configuration to Stripe.

Specific guides are available for integrating with popular IdPs:

*   **Microsoft Entra ID (formerly Azure Active Directory):** [Single sign-on with Entra ID](/get-started/account/sso/entra-id)
*   **Google Workspace:** [Single sign-on with Google Workspace](/get-started/account/sso/google-workspace)
*   **Okta:** [Single sign-on with Okta](/get-started/account/sso/okta)
*   **OneLogin:** [Single sign-on with OneLogin](/get-started/account/sso/onelogin)
*   **Other SAML Identity Providers:** [Single sign-on with SAML Identity Provider](/get-started/account/sso/other)

For a general overview and initial setup, refer to:

*   **Single Sign-On (SSO):** [Overview of SSO setup](/get-started/account/sso)

### SCIM Provisioning

SCIM provisioning automates user lifecycle management in Stripe.

*   **Set up SCIM provisioning:** [Learn how to set up SCIM provisioning](/get-started/account/sso/scim) to automatically provision and deprovision team members based on your IdP.
*   **Group-Based Role Assignment:** Once SCIM is set up, you can leverage [Group-based role assignment](/get-started/account/sso/group-role-assignments) to dynamically assign roles to users based on their group memberships synchronized via SCIM.

### Consolidating SSO Integrations

If you manage multiple Stripe accounts, it's recommended to consolidate your SSO integrations for a streamlined experience.

*   **Consolidate your SSO integrations:** [Learn how to consolidate SSO integrations](/get-started/account/orgs/sso-consolidation) across multiple accounts, particularly when using Stripe Organizations.

### Troubleshooting SSO

Encountering issues with SSO setup is common. This section provides guidance on resolving them.

*   **Troubleshoot SSO:** [Learn how to resolve common SSO errors](/get-started/account/sso/troubleshooting), including expired SAML requests, invalid SAML responses, and incorrect issuer IDs or IdP URLs.