---
title: "Set up SSO and SCIM"
slug: "/help/account/sso-and-scim"
sidebar_position: 1
tags: ["integrations","sso","scim","user management","login"]
last_updated: "2026-07-07T18:45:41.347Z"
zendesk_id: 32114239862291
zendesk_url: "https://help.walnut.io/hc/en-us/articles/32114239862291-Set-up-SSO-and-SCIM"
locale: "en-us"
category: "Connect and Optimize"
section: "Single Sign On (SSO)"
product: "account"
displayed_sidebar: "accountSidebar"
---

## About

Single Sign-on (SSO) allows users to login to Walnut using their existing account information from Google, Microsoft, Okta or many others. 

-   SSO / SCIM is a paid feature, so if you haven’t got SSO / SCIM as part of your current package, reach out to your CSM for details.
-   You must be a Walnut admin to set up SSO and SCIM.

---

## Set up SSO and SDIM

### Step 1: Select your SSO provider

Walnut supports custom SAML and OpenID connections as well as most providers, including Okta and Azure AD. 

Go to this [website](https://workos.com/docs/integrations) (https://workos.com/docs/integrations) for a list of SSO providers.

You can only have one SSO provider, but you change providers - see the section in this article [Change your SSO provider.](#h_01J4PFF9ZRYT2MZEVJS2X38NHZ)

---

### Step 2: Set the SSO toggle to ON

1.  Navigate to **Company Settings** and scroll down to the **SSO** section.  
    ![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeE2GQO3JNEMWWOoYLB2MThumEZYZaNHWfAbQz9-QSZAs9wLh8tPIbja3Sd77qcEVdqq0-5WEgVnSVNkXP96Av6ZPLSQgOpXc5BblZr8vNI6d4hh03Uwm760rRujWeyYkvXgUxOa2mIVOpNF26JCjV_RoGw?key=Igd71-M5qqXzD6c0ts_OpA)  
      
    
2.  The **Configure SSO** toggle default is OFF, so set it to ON. In the image above OKTASAML is already connected. But you will click **Set up** and follow the on-screen workflow / wizard.

---

### Step 3: Verify your domain

Before your connection can go **Active**, WorkOS needs to confirm you own your company's email domain (e.g. `yourcompany.com`).

-   During the setup wizard, you'll see a **domain verification** prompt if your domain isn't verified yet. This is a separate step from picking your SSO provider — you can finish entering your IdP details (metadata, certificate) and still see this prompt, since domain ownership and provider configuration are checked independently.
-   Enter your domain when prompted. WorkOS will give you a **DNS TXT record** to add, something like:
    ```
    Host: yourcompany.com (or @)
    Type: TXT
    Value: workos-verification=<token>
    ```
-   Add that record in your DNS provider (e.g. Cloudflare, GoDaddy, Route 53 — wherever your domain's nameservers are managed). If you're not sure who manages your DNS, check with your IT team.
-   Verification is automatic once the record is live — usually within minutes, but can take longer depending on DNS propagation. You don't need to click anything else; WorkOS detects it and marks the domain **Verified**.
-   Until the domain is verified, your connection will stay in **"Setup in progress"** status even if your IdP configuration looks complete. If it's been a while and status hasn't updated, double check the TXT record was added correctly, or reach out to support.

---

### Step 4: Complete the SCIM on-screen workflow

-   Each provider has a slightly different on-screen workflow / wizard but the principles are the same. For example, the OKTA workflow includes the steps shown in the screenshot.
-   Walnut doesn’t support Push Groups, so ignore steps that relate to Push Groups.
-   It’s important to include all Walnut users as part of the SCIM setup otherwise they won’t be able to login using their Walnut username and password.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdUORxsxue9sP-IXx3ZDS-bWBMkBiciIyhPp_L1aLiDu9HcRumUYYAEKyPNklMI7PWtFMjYHGuEuMzC_BZfCeZxjr2Z5nCL2dOPnxt_VG2fnp7so6Y-NTjPQnRFKXdh4HoiKrp3mWakFpw2h2AFnGW9gaI?key=Igd71-M5qqXzD6c0ts_OpA)

---

### Step 5: Test the connection

This is the final step in the workflow.

Access your company’s portal to test the connection.

-   Once SCIM is enabled, provisioned users will receive an email to join Walnut or they can go directly to [https://app.teamwalnut.com](https://app.teamwalnut.com)/ and log in.
-   Users initially receive the Presenter role but you can change that in **Company Settings>Users**.

---

## Disable SSO

Set the **Configure SSO** toggle to OFF. When off, users will not be directed to the SSO login page and they will have to login manually. 

To reactivate, set the **Configure SSO** toggle to ON.

---

## Change your SSO provider

On the **Configure SSO** line, click **Change** and follow the workflow / wizard.

---

## Remove your SSO provider

On the SSO row, click the **X** button. 

To add a different provider, repeat steps 1 - 4 in the section [Set up SSO and SDIM.](#h_01J4PFF9ZR8EWSMC28N1RYG99F)

---