Ory Console SSO

info

Ory Console SSO is available on Ory Enterprise plans.

The Ory Console supports Single Sign-On (SSO) via OpenID Connect (OIDC) or SAML. This allows you to use your existing identity provider (IdP) to authenticate users of the Ory Console.

You configure SSO in the workspace settings: enroll the workspace in an SSO organization, add the email domains your organization owns, prove ownership of each domain with a DNS TXT record, and connect your IdP through a guided onboarding portal.

Once configured, users with email addresses under a verified domain are connected to your organization the first time they sign in through your IdP. After that, they must use SSO to log in to the Ory Console. To require SSO before anyone can access the workspace and its projects, restrict access to your workspace.

Prerequisites

• You are an owner of the workspace.
• You can publish DNS TXT records for every email domain you want to enroll.
• You can create applications in your IdP, for example Microsoft Entra ID, Okta, or Google Workspace.

Configuration

Follow these steps to configure SSO for your workspace. All steps happen in your workspace's settings.

Step 1: Enroll the workspace

1. Open the workspace, and go to Settings.
2. Scroll down to the Single Sign-On (SSO) section, and click Configure Single Sign-On now.

Step 2: Add your email domains

Under Email domains, enter a domain such as example.com and click Add. Repeat for every domain your organization uses for email addresses.

• Public email domains such as gmail.com can't be added.
• A domain can belong to only one SSO organization. If another organization already manages the domain, adding it fails.
• Subdomains are separate domains. Add example.com and eu.example.com individually if users have email addresses under both.

Step 3: Verify domain ownership

Ory routes sign-ins to your organization only for verified domains. Each domain you add starts a DNS TXT verification:

1. Click Verify domains.
2. Expand the domain row to reveal the Record name and Record value.
3. Publish a TXT record in your DNS zone with exactly these values. The record name has the form _ory-domain-verification.example.com.
4. Wait for the status badge on the domain row to change to Verified. Ory rechecks pending domains automatically, but the interval grows after every failed check. After you publish the record, click Verify domains again to trigger an immediate check.

A domain row shows one of these statuses:

Status	Meaning
Not started	Verification has not been queued yet. Click Verify domains.
Pending verification	Ory is looking for the TXT record. Sign-ins for this domain are not routed to your organization yet.
Verified	The TXT record was found. Sign-ins for this domain go through SSO.
Verification failed	The record was not found within 14 days, or a previously verified record disappeared. Fix the DNS record and click Verify domains.
Action required	The domain was enrolled before domain verification existed and has no record yet. See Grandfathered domains.

Keep the TXT record in place. Ory rechecks verified domains every 12 hours. If the record is missing on four consecutive checks, the domain falls back to Verification failed and its sign-ins stop routing to your organization until you restore the record.

Step 4: Configure your identity provider

1. Click Configure SSO now. The onboarding portal opens in a new tab.
2. Choose Configure SSO and select your IdP. Guided setups exist for Microsoft Entra ID, Okta, and Google Workspace, and for other common providers such as Auth0, JumpCloud, OneLogin, PingOne, and Rippling. Any other OIDC or SAML compliant IdP works through the Generic OIDC or Generic SAML option.
3. Follow the steps in the portal. They walk you through creating the application in your IdP, copying the redirect or assertion consumer URL, mapping attributes, and entering the client credentials or SAML metadata.
4. Finish with the Test Single Sign-On step to confirm the connection works.

Back in the workspace settings, the SSO status changes to Configured. To change the provider later, open the ⋯ menu next to the status and click Configure SSO.

The onboarding portal is the same tool Ory offers for self-service organization onboarding in your own projects.

Step 5: Connect your account

Your own account is not bound to the organization until you authenticate with your IdP once. Until then you can still log in with your password, and access restrictions stay disabled. You can connect your account in two ways.

From your account settings, without logging out:

1. Click Connect account, either in the banner at the top of the Console or next to Restrict access to this workspace in the SSO section, and confirm with Link now. This opens your account settings, scoped to your organization, so only its SSO connections are offered.
2. Click your provider and authenticate with your IdP, including any additional steps such as multi-factor authentication.
3. After successful authentication you are redirected back to the Ory Console. Your account is now linked to the organization.

From the login page:

1. Log out of the Ory Console.
2. On the login page, enter your email address. Because its domain is verified, a Login with SSO button appears. Click it.
3. Click your provider and authenticate with your IdP. You might be asked to enter your existing Ory Console password one last time to link the accounts.
4. After successful authentication you are redirected back to the Ory Console and logged in.

Every other user whose email address is under a verified domain is bound to the organization the same way, either through the Connect account banner or through Login with SSO the next time they log in. This includes users who are invited only to a project.

Grandfathered domains

Domains that were enrolled before domain verification became available keep working without a DNS record until October 31, 2026. After that date, sign-ins for unverified domains stop routing to your organization.

Such domains show an Action required badge and a notice in the Email domains section. To keep SSO working:

1. Click Generate DNS record on the domain row.
2. Publish the TXT record as described in Step 3.
3. Click Verify domains and wait for the badge to change to Verified.

Restrict access to your workspace

In addition to forcing all users of your organization to use SSO, you can also restrict access to your workspace and all projects within it to members of the organization.

You must have connected your own account first. Otherwise the setting is disabled, because at least one organization member must keep access to the workspace. Then go to Restrict access to this workspace in the SSO section and choose one of:

• All invited members (default): Everyone who is invited to the workspace or to one of its projects keeps access, regardless of their email domain.
• Invited organization members only: Only users who have accepted an invitation to the workspace or to one of its projects and are part of the organization can access them. A user who has not logged in through SSO yet is locked out until they do.

warning

Make sure that any user who needs access to the workspace or to a project has accepted their invitation and logged in through SSO before enabling this setting. To see who would be locked out, check the workspace Members page and the Members page of each project.

Session lifespan

By default, Console sessions created through SSO last 30 days. To change how long members who sign in through SSO stay signed in, click Change under Session lifespan and pick a preset (1 hour, 8 hours, 24 hours, 7 days, 30 days), or choose Custom and enter a duration such as 12h30m. Custom durations must be between 1 minute and 8760 hours (1 year). Select Project default to reset the override.

Break-glass account recovery

When your SSO provider is unavailable due to an outage or misconfiguration, organization members can't sign in. Break-glass account recovery lets designated users bypass SSO enforcement and recover access to their accounts through email.

Enable account recovery for a member

Go to Workspace Settings > Members. For workspaces with SSO enabled, an Allow account recovery toggle appears for each organization member. Enable this toggle for the designated user.

You can also use the workspace members API:

curl -X PATCH "https://api.console.ory.com/workspaces/$WORKSPACE_ID/members/$MEMBER_ID" \
     -H "Authorization: Bearer $ORY_SESSION_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"break_glass": true}'

To disable account recovery, set break_glass to false or use the toggle in the Console.

How recovery works

1. The designated user navigates to the account recovery page and enters their email address.
2. Ory sends a recovery code to the email address.
3. The user enters the recovery code and gets a session.

warning

Grant account recovery access only to a small number of trusted users, such as organization administrators. Any user with this access can bypass SSO and recover their account through email.

Remove a domain

Click the trash icon on a domain row and confirm. Afterwards:

• New accounts with this email domain can sign up without SSO.
• The domain becomes available for other organizations to claim.
• Members who already signed in with SSO stay bound to your organization and must keep using SSO.
• Adding the domain back starts a new verification with a new DNS TXT record.

Disable SSO

Open the ⋯ menu next to the SSO status, click Disable SSO, and type the workspace name to confirm. This deletes the SSO organization together with its domains and provider configuration. Members can log in with their email and password again.

Known limitations

• You configure SSO per workspace. If you have multiple workspaces, configure SSO separately for each. A domain can be enrolled in only one workspace. Users do not need a workspace role to sign in with SSO.
• Access restriction and provider configuration require a workspace owner.

Troubleshooting

• A domain stays in "Pending verification". Confirm the TXT record is published on the exact record name, for example with dig TXT _ory-domain-verification.example.com. DNS changes can take a while to propagate. Once the record resolves, click Verify domains to trigger an immediate check instead of waiting for the next automatic one.
• The "Login with SSO" button does not appear. The email domain is not verified yet, or SSO is still Pending configuration because no provider has been set up in the onboarding portal.
• The IdP is unreachable and users can't log in to the Ory Console. Use break-glass account recovery for designated administrators. If you need further help, email [email protected] with:
  • The email address you are trying to log in with.
  • The error message you are seeing (if any).
  • The time and date when the issue occurred.
  • Any additional details that may be relevant, for example steps you took before encountering the issue.