> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aireserve.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Sign in to the AI Reserve portal through your company identity provider (SAML 2.0), and optionally make it the only way in for your organization.

AI Reserve supports SAML 2.0 single sign-on with your company identity provider
(Okta, Microsoft Entra ID, Google Workspace, and any other SAML 2.0 IdP). SSO is
set up for your organization by our team: send the SAML metadata for your IdP
and the email domains your team signs in with to your AI Reserve contact.

## Signing in with SSO

Once SSO is connected, members on your organization's email domains enter their
work email on the [portal sign-in page](https://portal.aireserve.com/login) and
choose **Continue with SSO**. They are sent to your identity provider and come
back signed in. No AI Reserve password is involved, and your IdP's own policies
(MFA, device trust, session lifetime) apply.

Only members your admin has already added to the organization can sign in.
Someone who is not a member does not get an account by completing SSO.

## SSO-required mode

By default, SSO is one option next to password and Google/Microsoft sign-in.
Your admin can ask us to switch your organization to **SSO-required** mode:

* The sign-in page recognizes your organization's email domains and shows a
  single action, **Continue with your organization's single sign-on**. The
  password field and the Google and Microsoft buttons are not offered.
* The server enforces it independently of what the sign-in page shows. A
  sign-in for an address on your domains that did not come through your
  organization's SAML provider is refused, even if someone calls the sign-in
  endpoint directly, and any existing password or Google/Microsoft session on
  those domains is signed out the next time it is used.
* Members on other email domains (contractors, a partner firm) keep their
  current sign-in options.

> [!WARNING]
>
> **There is no admin bypass.** SSO-required mode has no "break-glass" password
> path for admins; a carve-out would be the weakest link in the control. If your
> identity provider is down, contact support and we will restore password sign-in
> for your organization. The change takes effect immediately.

Turning SSO-required mode on is an immediate, organization-wide change. Confirm
that every member on your domains can already sign in through your IdP before
you ask for it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.