--- title: "Single sign-on (SSO) in Amplitude" description: Integrate Amplitude with your business's SSO service. product: general lang: en last_updated: 2026-11-10 token_estimate: 1370 --- # Single sign-on (SSO) in Amplitude Single sign-on (SSO) is an authentication scheme that lets users use a single ID and password combination to log into multiple platforms, services, or systems. Amplitude supports SSO and is compatible with any SAML 2.0-compliant SSO provider, including: > For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`. - [Auth0](https://amplitude.com/docs/admin/single-sign-on/auth-0) - [AWS IAM Identity Center](https://amplitude.com/docs/admin/single-sign-on/aws-iam-identity-center) - [G Suite](https://amplitude.com/docs/admin/single-sign-on/g-suite) - [Microsoft Azure Active Directory](https://amplitude.com/docs/admin/single-sign-on/azure-active-directory) - [Okta](https://amplitude.com/docs/admin/single-sign-on/okta) - [OneLogin](https://amplitude.com/docs/admin/single-sign-on/one-login) - [Other](https://amplitude.com/docs/admin/single-sign-on/set-up-single-sign-on-sso-for-amplitude-using-another-service) providers not specifically named. Follow the provider-specific guide for setup and configuration details. ## Plan availability Single Sign-on (SSO) is available on the Growth and Enterprise plans. Go to [Amplitude pricing](https://amplitude.com/pricing) for plan details. | Plan | Allowance | How to access | | --- | --- | --- | | Free | Not included | [Upgrade your plan](https://amplitude.com/pricing) | | Plus | Not included | [Upgrade your plan](https://amplitude.com/pricing) | | Growth | Included | Included in plan | | Enterprise | Included | Included in plan | _Availability reflects the latest Amplitude plans. If your organization is on an older plan, your access may differ. Check your plan under [Plans & Billing in your organization settings](/docs/admin/account-management/account-settings#organizational-settings), or contact your Amplitude account representative._ ## SSO basics Before you enable SSO: - You can require members of your organization to sign in with SSO. Requiring SSO prevents users from signing in with their email and password, so make sure your SSO system works before you turn it on in Amplitude. - You can also automatically grant new users access to your organization through just-in-time provisioning. Amplitude only requires a new user to successfully authenticate with your identity provider. After Amplitude receives authentication, Amplitude adds the user to your organization. You can then configure roles for each new user to reflect their needs and the organization's needs. Enterprise customers with access to project [permissions](https://amplitude.com/docs/admin/account-management/user-roles-permissions) can also choose the default project(s) that JIT-provisioned users will have access to. ## What your identity provider must send When a user signs in through SSO, Amplitude looks for their email in the SAML assertion in this order: 1. The assertion subject. 2. An email claim attribute (`http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`). 3. An `emailaddress` attribute (case insensitive). 4. An `email` attribute (case insensitive). If Amplitude can't find a valid email, the user can't sign in. Most identity providers send the email by default. If yours doesn't, follow the provider-specific guide linked above to map the user's email into the assertion. ## Common questions ### How do I fix a 500 error when signing in with SSO? A 500 internal server error on SSO sign-in usually means a problem with your SAML certificate, and it can affect every user in your organization. To resolve it: 1. Make sure you can reach the Amplitude platform to upload a new certificate. If you need to turn off SSO to sign in and fix the problem, contact the Support team. 2. Check with your IT team whether the SAML certificate has expired. If it has, upload a new one. 3. Confirm the certificate uses the correct format. If it doesn't, have an Amplitude admin upload a correctly formatted certificate. ### Why am I seeing a Google Workspace 403 error on SSO sign-in? If you configured SSO through Google Workspace, you might see `403 Error: app_not_enabled_for_user` or `403 Error: app_not_configured_for_user`. Refer to [Set up SSO using G Suite](https://amplitude.com/docs/admin/single-sign-on/g-suite#troubleshoot-a-403-error) for the fix. ### What do I do if I can't sign in with a password? If your organization doesn't require SSO and you're signing in with an email and password, work through these steps: - Confirm the password is correct, and reset it if you've forgotten it. - Check whether the problem happens in another browser or in incognito mode. If it doesn't, clear your browser's cookies and cache. - Update your browser, restart your computer so the browser fully relaunches, and try again. - Confirm your browser is supported. Refer to [browser compatibility](https://amplitude.com/docs/get-started/browser-compatibility). - Turn off ad blockers and VPNs, or add Amplitude to their allowed lists. Both can make Amplitude behave unexpectedly. - If you signed up with EU data storage, sign in at [app.eu.amplitude.com/login](https://app.eu.amplitude.com/login). - If you've forgotten your organization's URL, contact Amplitude Support. They can tell you which organization is associated with your email address. If none of these resolve it, contact Amplitude Support and include your browser and its version number.