Vercel Logo

SAML and SSO

Plan tier

SAML SSO is available on Enterprise plans and as a paid add-on for Pro. Directory Sync requires Enterprise. The configuration described here assumes you have an identity provider (Okta, Microsoft Entra ID, or Google) and admin access to it.

Without SSO, Vercel team membership is its own thing. You invite by email, you remove by email. When someone leaves the company, you're trusting whoever offboards them to remember Vercel is on the list. If they don't, that person still has access to deployments, env vars, and production. Maybe forever.

SAML SSO turns Vercel into a downstream consumer of your identity provider. Sign-in flows through Okta, Entra ID, or Google. Sessions expire after 24 hours, requiring re-auth. Combined with Directory Sync, group memberships and offboarding propagate automatically: someone removed from your directory is removed from your Vercel team within hours, without anyone clicking anything in Vercel.

For Saturday, this is a "growth setup" lesson. You may not need it on day one, but the moment your team passes about ten people, or the moment a customer questionnaire asks if you use SSO, it pays for itself.

What are SAML SSO and Directory Sync?

SAML SSO makes your identity provider (Okta, Entra ID, Google) the front door for Vercel sign-in. Directory Sync goes one step further: groups in the IdP map to Vercel Access Groups, so joining, moving, and offboarding flow from the directory automatically.

Outcome

Saturday's team is configured with SAML SSO through your identity provider. Directory Sync maps IdP groups to Vercel Access Groups. Removing a user from the IdP removes them from Vercel.

Hands-on exercise 6.1

This is a longer lesson because it requires moving back and forth between two systems. The structure:

Requirements:

  1. In your IdP, create a new SAML application for Vercel
    • Single Sign-On URL: copy from Vercel's setup page
    • Audience URI / Entity ID: copy from Vercel's setup page
    • Name ID format: EmailAddress
    • Assert email, first name, last name (Vercel uses these for user provisioning)
  2. In your IdP, have the app's metadata handy. Some walkthroughs ask for the metadata XML, others for individual URLs and certificates.
  3. In Vercel, open Team Settings > Security & Privacy > SAML Single Sign-On and click Configure
  4. Follow the provider walkthrough for your IdP, copying values between the two systems as prompted. The exact fields vary by provider.
  5. Verify the connection by signing out of Vercel and signing back in through the IdP. A full round trip is your test; do it before you enforce anything.
  6. Decide on enforcement. You can let SAML coexist with password-based sign-in, or you can turn on Require Team Members to login with SAML for a stricter posture. The toggle is on the same page.
  7. Set up Directory Sync (Enterprise only) if you want automatic provisioning. Vercel will provide a SCIM endpoint URL and a token; configure those in your IdP's SCIM section.
  8. Map IdP groups to Access Groups. In Vercel's Directory Sync settings, link your IdP group "saturday-designers" to the Designers Access Group, and so on for Engineers and Founders.

Implementation hints:

  • Test the round trip before requiring it. The enforcement toggle, if flipped while your IdP is misconfigured, locks everyone out.
  • There is no per-account exemption. When Require Team Members to login with SAML is on, it's on for everyone, so the classic break-glass-account pattern doesn't exist here. Your safety nets are different: changing the SAML configuration drops enforcement until you re-enable it, and Vercel support can help with recovery if you're truly stuck. All the more reason to verify the flow first.
  • Directory Sync uses SCIM, the standard for provisioning. If you've set up SCIM for any other SaaS tool (Slack, GitHub, Datadog), the flow is identical.
  • IdP group names don't have to match Vercel group names. The mapping is explicit in the Directory Sync UI.
  • Most IdPs let you test the SAML flow before users see it. Use that. There's no "preview" button in Vercel itself, but your IdP usually has a "Test" or "Simulate" option for the app.

Try It

Sign out of Vercel completely. Visit your Vercel team's URL. You should be redirected to your IdP's login page:

Sign in to Saturday team
Continue with your company SSO →

Sign in via the IdP. After it succeeds, you should land back in Vercel, signed in. The session expires in 24 hours; you'll re-auth then.

If you set up Directory Sync, test offboarding (carefully, on a test user). Remove a test user from your IdP and wait a few minutes. They should disappear from Team Settings > Members in Vercel without you clicking anything. The exact timing depends on the IdP's SCIM push frequency; Okta typically syncs in under an hour, but it can be faster or slower.

Done-When

  • SAML SSO is configured through the provider walkthrough
  • A full sign-out and SSO sign-in round trip succeeds
  • (If Enterprise) Directory Sync is configured and IdP groups are mapped to Access Groups
  • (Optional, recommended) Require Team Members to login with SAML is enabled, after the round trip is verified

Troubleshooting

The SSO round trip fails with "Audience mismatch."

The Audience URI in your IdP config doesn't match the one Vercel expects. Copy it again from Vercel's setup page and paste it exactly into your IdP. Common gotcha: trailing slash difference.

The flow signs in but the user shows up as a Member, not in the right Access Group.

If you're using Directory Sync, the IdP group mapping isn't picking up. Confirm the SCIM endpoint is configured in the IdP and that the user's IdP group memberships are being pushed. If you're not using Directory Sync, you'll need to manually assign the user to an Access Group after their first sign-in.

A user removed from the IdP is still in Vercel.

Directory Sync runs on a push from the IdP. Check the IdP's SCIM logs to confirm the deprovisioning event fired. If it didn't, your IdP may not have automatic deprovisioning enabled for the SAML app; you may need to enable a "Push deprovisioning" or "Remove on disable" setting in your IdP.

Solution

There's no code in the repo. The state is across two systems:

IdP (Okta / Entra ID / Google)
  SAML App:  Vercel (Saturday team)
  Groups:    saturday-designers, saturday-engineers, saturday-founders

Vercel
  Team Settings > SAML SSO:  Configured
  Team Settings > Directory Sync:  Connected
  Group mappings:
    saturday-designers   ->  Designers (Project Viewer)
    saturday-engineers   ->  Engineers (Project Developer)
    saturday-founders    ->  Founders  (Project Admin)

The thing this fixes: offboarding. The thing it unlocks: every security questionnaire from here on out.

Up next: SSO controls who can sign in. Audit Logs record what they did once they were inside.

Was this helpful?

supported.