> ## Documentation Index
> Fetch the complete documentation index at: https://docs.realtimelca.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO)

> Let your users sign in to Real-Time LCA with your own identity provider.

Single sign-on lets people in your organization sign in to Real-Time LCA with the identity provider (IdP) you already use — no separate Real-Time LCA password to set, share, or reset.

SSO is set up per organization on request. An IT administrator asks for it by emailing [support@realtimelca.com](mailto:support@realtimelca.com), and we configure the connection together with you.

## Supported protocols

* **OpenID Connect (OIDC)**
* **SAML 2.0**

Most modern IdPs — Entra ID (Azure AD), Okta, Google Workspace, Ping, and others — support at least one of these.

<Note>
  This is different from the **Microsoft** button on the sign-in and activation screens. That option links a single user to their own Microsoft account. SSO connects *your organization's* IdP, so everyone on your email domain signs in through it. See [Activate your account](/user-guide/activate-account).
</Note>

## How users get access

Users are provisioned automatically the first time they sign in through your identity provider — no activation email, and no need to create each user in Real-Time LCA up front. Anyone your IdP lets through on a claimed domain gets a Real-Time LCA user in your organization on first sign-in.

<Note>
  Being provisioned puts someone in your organization; it does not give them a project. Project access is still granted separately under [Settings → Members](/user-guide/project/project-settings#members).
</Note>

Control who can reach Real-Time LCA the same way you control your other applications — by assigning the app registration to the right users or groups in your IdP.

## Before you request SSO

Have these in place on your side:

<Steps>
  <Step title="An app registration in your IdP">
    Create the application (OIDC or SAML 2.0) that will represent Real-Time LCA in your IdP.
  </Step>

  <Step title="Permission to add a redirect URI">
    Whoever sets this up needs to be able to add the redirect URI we give you to that app registration.
  </Step>

  <Step title="The email claim in the token">
    Real-Time LCA identifies users by email, so the token must carry an email claim.
  </Step>

  <Step title="Control of the email domain you want to claim">
    You can only claim a domain you own, and ownership has to be verified before the connection goes live.
  </Step>

  <Step title="A named admin for the connection">
    One person on your side owns the connection over time and is our point of contact for changes to it.
  </Step>
</Steps>

### Entra ID: add the email claim explicitly

In Entra ID the email claim is often missing by default. Two things to check:

* Add **email** as a claim under the app registration's **Token configuration**.
* Make sure each user's **mail** attribute is populated in the directory. If it is empty, no email claim is issued for that user and they cannot be matched to a Real-Time LCA user.

<Warning>
  Users whose token arrives without an email claim will not be able to sign in. Check this before rolling SSO out to everyone.
</Warning>

## How to request it

Email [support@realtimelca.com](mailto:support@realtimelca.com) from an IT administrator account and include:

* Your organization name in Real-Time LCA
* Which protocol you want to use — OIDC or SAML 2.0
* The email domain (or domains) you want to claim
* The named admin who will own the connection

We come back to you with the redirect URI to add to your app registration and the details we need from your side, verify the domain, and test the connection before it is switched on.

## Next steps

<Columns cols={2}>
  <Card title="Activate your account" icon="user-check" href="/user-guide/activate-account">
    How individual users activate and sign in today.
  </Card>

  <Card title="Account and user settings" icon="user-gear" href="/user-guide/account-and-user-settings">
    Profile, workspace users, and organizations.
  </Card>
</Columns>