> For the complete documentation index, see [llms.txt](https://docs.overleaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.overleaf.com/groups/overleaf-group-single-sign-on/group-sso-faqs.md).
# Group SSO FAQs
What kind of SSO do you support?
Overleaf offers a standard SAML-based SSO integration.
How do I set it up?
If you’re the administrator of an Overleaf Pro group subscription, group SSO is one of the optional features you can turn on for your group. To set up group SSO your users must be set up in an Identity Provider (IdP) that supports SAML 2.0, and you must be able to add Overleaf as a Service Provider in your IdP. See the [Setting up Group SSO](/groups/overleaf-group-single-sign-on/setting-up-group-sso.md) guide for the steps to follow.
Do you support Just in Time (JIT) Provisioning of user accounts?
Yes. Overleaf accounts are provisioned by users who receive email invitations to join their account to the group and link to their SSO identity.
Do you support SCIM?
Individual users provision their own Overleaf accounts, System for Cross-domain Identity Management (SCIM), is a standard for automation of user provisioning. Because your system will not be provisioning users in Overleaf, SCIM isn’t supported or required.
Do you support SP or IdP initiated flows?
Overleaf Group SSO only supports Service Provider (SP) initiated flows. Identity Provider (IdP) initiated flows are not supported. \
\
If your IDP provides a launch menu, you may be able to set your main Overleaf application as "hidden" and configure a second "bookmark application" for your launch menu which points to the main Overleaf SSO login page: .
Does Overleaf Group SSO support signed assertions and/or responses?
Yes, Overleaf Group SSO supports your Identity Provider signing assertions or responses, and requires that either the assertion or the entire response is signed. Optionally both may be signed, but this is not required.
The customer's Identity Provider (IdP) signs the SAML assertion or the entire response using its private key. Overleaf uses the IdP's public certificate to verify this signature.
Does Overleaf Group SSO support encrypted assertions?
Yes, Overleaf Group SSO supports IdP encrypted assertions using Overleaf's public certificate. Assertion encryption is not required, but is supported.
Your Identity Provider uses Overleaf's public certificate to encrypt the assertion. Only Overleaf, possessing the corresponding private key, can decrypt and read the encrypted data that is sent to us.
Does a user need to be created in our IdP before they create an Overleaf account?
If your subscription has SSO enabled, it’s best to have users created in your IdP before they’re invited to join the subscription. This allows users to create their Overleaf accounts, link to their SSO identity, and join your subscription in one step. However, this is not required, as your team members can link their Overleaf account to their SSO identity at any time.
If I delete a user in my identity system, will their Overleaf account be deleted?
No. Deleting a user in your IdP will not delete their account in Overleaf. Overleaf accounts are deleted in Overleaf by the account owner. This is either the user themselves or the manager of the account (when [Managed Users](/groups/user-management/managed-user-accounts.md) is enabled).
Can SSO be made an exclusive login option?
Yes. If your group uses our [Managed Users](/groups/user-management/managed-user-accounts.md) feature, the managed user accounts will be set to use SSO exclusively. See [Linking users to Group SSO](/groups/overleaf-group-single-sign-on/linking-users-to-group-sso.md). Users will have to create a temporary Overleaf-specific password during the account creation and SSO linking process. For each user, SSO will become exclusive once they have linked their SSO identity to their Overleaf account and accepted the invitation to have their account managed. Administrators can check on the management and SSO status of each account on their group administration page.
I'm seeing an error when I try to log in—what do I do?
Please see [Logging in with group single sign-on](https://www.overleaf.com/learn/how-to/Logging_in_with_your_group_single_sign-on) for troubleshooting suggestions. If you’re still having problems, please notify your group administrator and [contact us](https://www.overleaf.com/contact) if the issue cannot be resolved by them.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.overleaf.com/groups/overleaf-group-single-sign-on/group-sso-faqs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.