To manage the members of your team through a third-party identity provider like Okta or Auth0, you can set up the Security Assertion Markup Language (SAML) feature from the team settings.
To enable this feature, the team must be on the Enterprise plan and you must hold an owner role.
All team members will be able to log in using your identity provider (which you can also enforce), and similar to the team email domain feature, any new users signing up with SAML will automatically be added to your team.
If needed, you can then also automatically assign a users Hobby account with a specific role within your team by setting up Directory Sync.
SAML can be configured from the team settings, under the SAML Single Sign-On section. Clicking Configure will open a walkthrough that helps you configure SAML SSO for your team with your identity provider of choice.
After completing the steps, SAML will be successfully configured for your team.
Once you have configured SAML, your team members can use SAML SSO to log in or sign up to Vercel. Click "Continue with SAML SSO" on the authentication page, then enter your team's slug.
Your team slug is the identifier in the URLs for your team. For example, the identifier for vercel.com/acme is acme.
Click Continue with SAML SSO again and you will be redirected to your third-party authentication provider to finish authenticating. Once completed, you will be logged into Vercel.
SAML SSO sessions last for 24 hours before users must re-authenticate with the third-party SAML provider (unless Directory Sync is configured).
You can customize your Vercel login page which only shows the option to log in with the SAML SSO button. This prevents your team members from logging in with an account that's not managed by your identity provider.
To use this page, you can set the saml query param to https://vercel.com/login?saml=team_id.
For additional security, SAML SSO can be enforced for a team so that all team members cannot access any team information unless their current session was authenticated with SAML SSO.
You can only enforce SAML SSO for a team if your current session was authenticated with SAML SSO. This ensures that your configuration is working properly before tightening access to your team information, this prevents lose of access to the team.
Vercel is SCIM compliant and therefore when a user is removed from your SAML provider, they are automatically offboarded from Vercel.
Was this helpful?