Single sign-on (SSO) and MFA

With Teti Business your team can sign in with your company's identity provider — Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud or any provider that supports SAML 2.0 — instead of email links, Google or Apple. When someone leaves the company and you disable them in your provider, they can no longer sign in to Teti.

SSO is included in every Business plan. Only the owner of the organization can set it up, in Settings → Organization.

Setting it up takes four steps:

1. Verify your email domains.
2. Create a SAML app in your identity provider.
3. Paste its metadata into Teti and test the sign-in.
4. Optionally, require SSO for everyone on your domains.

1. Verify your domains

SSO works for the email domains your organization owns (for example yourcompany.com).

1. Go to Settings → Organization → Domains, type your domain and click Add.
2. Teti shows a TXT record: its name is your domain and its value starts with teti-domain-verification=.
3. Add that TXT record in your DNS provider (Cloudflare, Aruba, GoDaddy, Route 53…).
4. Back in Teti, click Verify. DNS changes can take a few minutes; if the record isn't found yet, try again later.

A verified domain belongs to one organization only. You can add several domains (for example yourcompany.com and yourcompany.it), and you can keep the TXT record in place.

Colleagues find your organization

Once a domain is verified, people who start using Teti with an email on that domain see your organization (name and logo) in a "Your company uses Teti" message, on the web and in the app, and can ask to join. Teti suggests it once; colleagues who were already using Teti before you verified the domain find it with Find your company in the organization switcher (on the web, open the menu with your name and point to your organization; in the app, Settings → Workspace). This is on by default, like in ChatGPT Business; you can turn it off in Settings → Organization → Domains → Colleagues at your company.

• Requests appear in Settings → Members, where the owner approves them, choosing a Standard or Premium seat, or declines them. The owner also gets an email for each request (you can turn it off in Settings → Organization → Domains → Colleagues at your company). Whoever is approved gets an email and a notification.
• Join without approval (off by default): people join right away with a free Standard seat. If none are left, their request waits for your approval.
• Whoever hides the message can still find your organization with Find your company in the organization switcher.

Discovery works without SSO too: verifying the domain is enough.

2. Create a SAML app in your identity provider

In Settings → Organization → SSO Teti shows the two values your provider needs:

Teti	Okta	Microsoft Entra ID	Google Workspace
ACS URL	Single sign-on URL	Reply URL (Assertion Consumer Service URL)	ACS URL
Entity ID	Audience URI (SP Entity ID)	Identifier (Entity ID)	Entity ID

The Entity ID is also the address of Teti's SAML metadata, if your provider can import it.

Teti uses the person's email address to sign them in, so make sure your provider sends it — as the Name ID (format EmailAddress) or as an email attribute. First and last name are used if present.

Okta

1. Applications → Applications → Create App Integration → SAML 2.0, name it "Teti".
2. Single sign-on URL: Teti's ACS URL. Audience URI (SP Entity ID): Teti's Entity ID.
3. Name ID format: EmailAddress. Application username: Email.
4. Finish, then in the Sign On tab copy the Metadata URL.
5. In Assignments, assign the people or groups who should use Teti.

Microsoft Entra ID

1. Enterprise applications → New application → Create your own application, name it "Teti", choose Integrate any other application you don't find in the gallery (Non-gallery).
2. Single sign-on → SAML. In Basic SAML Configuration set Identifier (Entity ID) to Teti's Entity ID and Reply URL to Teti's ACS URL.
3. Leave the default Attributes & Claims (they include the email address). If your users' sign-in name (UPN) isn't their email, set the Unique User Identifier to user.mail.
4. In SAML Certificates, copy the App Federation Metadata Url.
5. In Users and groups, assign the people or groups who should use Teti.

Google Workspace

1. In the Admin console: Apps → Web and mobile apps → Add app → Add custom SAML app, name it "Teti".
2. In Google Identity Provider details, download the IdP metadata.
3. ACS URL: Teti's ACS URL. Entity ID: Teti's Entity ID. Name ID format: EMAIL, Name ID: Basic Information > Primary email.
4. Turn the app ON for everyone or for the organizational units that should use Teti.

Other providers

Any SAML 2.0 provider works with the same two values. The response (or the assertion inside it) must be signed. Encrypted assertions aren't supported: leave assertion encryption off.

3. Connect the provider and test

1. In Settings → Organization → SSO → Provider metadata, paste the metadata URL (it must start with https://) or the metadata XML, then click Save.
2. Teti shows Provider connected and until when the provider's certificate is valid.
3. Click Test sign-in and sign in with an account on your verified domain.

When your provider renews its certificate, click Update from metadata (if you used a metadata URL) or paste the new metadata.

4. Require SSO

Once a domain is verified and someone has signed in successfully with SSO, you can turn on Require SSO. From then on, everyone with an email on your verified domains — including people who already had a Teti account with that email — signs in only with SSO, on the web and in the Teti app: email links, Google and Apple are refused for those addresses, and Teti sends them to your provider's sign-in instead.

People who are already signed in stay signed in until their session ends or they sign out; their next sign-in goes through SSO.

Multi-factor authentication (MFA)

MFA is set in your identity provider, where it applies to all your company's apps: for example Okta sign-on policies, Microsoft Entra Conditional Access or Google 2-Step Verification. When SSO is required, everyone on your domains goes through your provider's MFA to use Teti.

How your team signs in

• On the web: on the sign-in page, click Sign in with SSO and enter your work email.
• In the Teti app: tap Sign in with SSO. The sign-in opens in the browser and brings you back to the app.
• From your provider's dashboard (for example the Teti tile in Okta): it works too, and goes through Teti's sign-in.

If SSO is required for your email, the other sign-in options take you to SSO automatically.

If something goes wrong

Message	What to check
SSO isn't set up for this domain	The domain isn't verified in Teti, or Business isn't active.
The SSO provider sent an email from a domain your organization hasn't verified	The email sent by your provider is on another domain: verify that domain too, or send the address on your verified domain.
The SSO provider didn't send an email address	Send the email as the Name ID (EmailAddress) or as an email attribute.
SSO sign-in failed	The provider's certificate changed (update the metadata), the Entity ID or ACS URL are wrong, the response isn't signed, or the assertion is encrypted.

When Business ends

SSO stops working with Business: people sign in again with email links, Google or Apple. Your domains and provider settings are kept, and work again if you reactivate Business.

Privacy

Teti stores your verified domains and your provider's public SAML settings (identifier, sign-in address and signing certificates). Passwords and MFA factors stay with your provider and never reach Teti. Everything is stored with the rest of your Teti data.