SSO (single sign-on)

Unit Oncall can require an Organization's members to authenticate through specific providers before they are allowed in. This is available on the Business plan and above.

Provider sign-in requirement (available now)

An Organization owner or admin can set required_sso_providers to one or more of google and github. When set, every member must have signed in through one of those providers to enter the Organization; members whose account has no matching linked provider are blocked until they link and use one.

You can also enable sso_step_up_enabled to re-prompt members for their required provider at most once every 24 hours.

Both are configured in Organization settings. Setting them requires a plan that includes required SSO; submitting them on a lower plan is rejected.

Pair this with require_mfa for a stronger policy — for example, "everyone must sign in with Google and have a second factor."

The requirement is enforced when a member enters the Organization, not only at the login screen. Signing in and entering an Organization are separate steps — see Authentication.

External identity providers (planned)

Direct integration with external enterprise identity providers over SAML or OIDC — for example Okta, Azure AD / Entra ID, or OneLogin — is planned and not yet available. Today, "SSO" in Unit Oncall means requiring the built-in Google or GitHub providers as described above. This page will be updated when external IdP integration ships.

Related

• Authentication — all sign-in methods.
• Multi-factor authentication — pair SSO with a required second factor.
• Organization settings — required_sso_providers and sso_step_up_enabled.