---
title: "Single Sign-On (SSO) Integration Overview"
description: "Single Sign-On (SSO) allows customers to securely access our services using their organization’s existing identity system"
url: https://help.tagd.ai/en/articles/30-single-sign-on-sso-integration-overview
collection: "Integrations"
updated: 2026-10-28
language: en
alternates: [sv, nb, fi]
---

# Single Sign-On (SSO) Integration Overview

Single Sign-On (SSO) allows customers to securely access our services using their organization’s existing identity system

Tagd supports **Single Sign-On (SSO)** to make authentication secure, seamless, and easy to manage for organizations of all sizes.

We provide SSO integrations using the two most widely adopted industry standards:

### **SAML 2.0**

[**Single Sign-On (SSO) via SAML**](https://help.tagd.ai/en/articles/31-single-sign-on-sso-via-saml.md)

### **OpenID Connect (OIDC)**

[**Single Sign-On (SSO) via OpenID Connect (OIDC)**](https://help.tagd.ai/en/articles/36-single-sign-on-sso-via-openid-connect-oidc.md)

### Benefits

**Users authenticate using your existing identity system**  
All user authentication is handled by your identity provider, allowing users to sign in using their existing organizational credentials without needing a separate Tagd password.

**Centralized user and access management**  
User accounts are automatically created on first login and access is controlled through your identity provider. Removing a user in your identity provider, or unassigning them from the Tagd application, immediately prevents new sign-ins. For a complete offboarding, also deactivate the user in Tagd.

**Compatibility with leading identity providers**  
Tagd supports industry-standard SAML and OpenID Connect protocols, enabling integration with widely used identity providers such as Microsoft Entra ID (Azure AD), Okta, and others.

**Improved security**  
Authentication is managed by your identity provider, allowing enforcement of security policies such as multi-factor authentication and conditional access. With a SAML metadata URL, Tagd picks up a rotated signing certificate automatically, as long as the old and new certificates overlap for at least 6 hours.