All team members will be able to log in using your identity provider (which you can also enforce), and similar to the team email domain feature, any new users signing up with SAML will automatically be added to your team.
SAML can be configured from the team settings, under the SAML Single Sign-On section. Clicking Configure will open a walkthrough that helps you configure SAML SSO for your team with your identity provider of choice.
After completing the steps, SAML will be successfully configured for your team.
Once you have configured SAML, your team members can use SAML SSO to log in or sign up to Vercel. Click "Continue with SAML SSO" on the authentication page, then enter your team's slug.
Your team slug is the identifier in the URLs for your team. For example, the identifier for vercel.com/acme is
Click Continue with SAML SSO again and you will be redirected to your third-party authentication provider to finish authenticating. Once completed, you will be logged into Vercel.
SAML SSO sessions last for 24 hours before users must re-authenticate with the third-party SAML provider (unless Directory Sync is configured).
You can customize your Vercel login page which only shows the option to log in with the SAML SSO button. This prevents your team members from logging in with an account that's not managed by your identity provider.
To use this page, you can set the
saml query param to
For additional security, SAML SSO can be enforced for a team so that all team members cannot access any team information unless their current session was authenticated with SAML SSO.
You can only enforce SAML SSO for a team if your current session was authenticated with SAML SSO. This ensures that your configuration is working properly before tightening access to your team information, this prevents lose of access to the team.
Vercel iscompliant and therefore when a user is removed from your SAML provider, they are automatically offboarded from Vercel.