Signing in to Deck
Deck supports multiple ways to sign in to the Console. All plans include social login. Enterprise plans unlock identity provider integrations for organizations that need centralized access control.Social login
Every Deck account can sign in using email, Google, or GitHub. There is nothing to configure. Select your provider on the sign-in page and you’re in.Enterprise SSO
Available to organizations on our Enterprise plan.
Supported protocols and providers
Deck supports Enterprise SSO via SAML 2.0 and OpenID Connect (OIDC). Guided setup is available for the following SAML identity providers:- Microsoft Entra ID
- Google Workspace
- Okta Workforce
Getting started
To get started, contact your Deck account team and ask them to enable SSO configuration for your organization. Once enabled, a Security tab appears in Organization Settings where an Admin can set up the connection. Before you begin, make sure you can publish DNS records for your company’s email domain and that you have admin access to your identity provider.Setting up a connection
1
Verify your domain
In Organization Settings > Security, add your company’s email domain. You’ll receive a DNS TXT record to publish. Once the record is verified, members with a matching email address will sign in through your identity provider when the connection is active.
2
Choose your identity provider
Select Microsoft Entra ID, Google Workspace, or Okta Workforce for a guided setup, or choose custom SAML or OIDC for any other provider.
3
Configure the connection
Follow the guided steps for your provider. For custom SAML, you’ll be given an ACS URL and Entity ID to enter in your IdP, and your IdP must send the user’s email address as an attribute. For OIDC, you’ll need your provider’s client ID, client secret, and endpoints.
4
Test the connection
Run a test sign-in to confirm the connection works end to end. Testing does not affect existing members.
5
Activate the connection
Once activated, all members with a matching email domain must sign in through your identity provider. Changes to an active connection take effect immediately, so edit with care.
How it works
Once SSO is configured for your organization, members with a matching email domain are automatically added to your organization when they sign in through your identity provider. No invite is required. Members who joined through SSO cannot leave the organization on their own. Admins can remove them in Organization Settings, but if the member is not also removed from your IdP, they will rejoin on their next sign-in.Directory Sync
Available to organizations on our Enterprise plan. Requires an active Enterprise SSO connection.
Setting up Directory Sync
To get started, contact your Deck account team and ask them to enable Directory Sync for your organization. Once enabled, an Admin can set it up from Organization Settings > Security.1
Connect your identity provider
Deck selects the provider from your SSO connection. For SCIM providers, you’ll receive a SCIM endpoint URL and a bearer token to enter in your IdP’s provisioning settings. For Google Workspace, you’ll upload service account credentials instead.
2
Review the attribute mappings
Confirm the mappings for username, email, first name, and last name.
3
Test provisioning
Assign a test user to Deck in your IdP and confirm they appear in your organization.
How it works
- Provisioning: Users assigned to Deck in your IdP are added to your organization. If a user already has a Deck account with the same verified email, that account is linked instead of creating a new one.
- Updates: Changes to a user’s name or email in your IdP sync to Deck. Synced fields cannot be edited in Deck.
- Deprovisioning: When a user is removed or deactivated in your IdP, their Deck account is deactivated and all of their active sessions are signed out immediately.