---
title: "Connect single sign-on per organisation · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/organisation-sso
updated: 2026-10-20
licence: "All rights reserved"
---

# Connect single sign-on per organisation

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning)
- Rule: Let each business organisation connect its own identity provider through SAML 2.0 or OpenID Connect, and route its users there by verified email domain.
- How: Store one connection per organisation, with the provider's metadata or issuer. Ask for the email first, then send people from a [verified domain](https://agentwranglers.se/playbook/accounts/organisations-and-teams/verified-domains) to their provider. Match returning users by the provider's stable ID, as [keep your own user ID](https://agentwranglers.se/playbook/accounts/sign-in-methods/own-user-id) says. Create users on first sign-in only when the organisation allows it. Keep sign-in started by the provider, called IdP-initiated SAML, off unless a customer needs it. The protocol checks are in [check every step of single sign-on](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/single-sign-on).
- Check: On staging, start sign-in as `ana@acme.example`. The browser goes to Acme's test provider. Start as `bo@other.example`, and the normal sign-in page appears.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/organisation-sso`.

- Next: [Let organisations require single sign-on](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/require-sso)
- [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning)