Description

Ensure SAML Single Sign-On (SSO) is configured for the Vercel team with the organization's identity provider, such as Okta, Microsoft Entra ID, or Google Workspace. This lets team members sign in to Vercel with their company account, so access is managed in one central place.

Rationale

Without SSO, team members sign in with personal Git or email logins that do not follow the organization's MFA and sign-in policies. Offboarding also depends on someone remembering to remove each user from Vercel. Configuring SAML SSO makes the identity provider the central place that controls access to Vercel.

Impact

  • Team members can sign in with their company account

  • The IdP's MFA and sign-in rules apply to Vercel

  • Access can be removed centrally in the IdP

Default Value

By default, SAML SSO is not configured. It is available on the Enterprise plan, or on Pro as a paid add-on.

Pre-Requisites

  • Team Owner role

  • Enterprise plan, or Pro plan with the SAML SSO add-on

  • Admin access to the identity provider

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Security & Privacy.

  4. In the Authentication and User Provisioning section, verify that SAML is configured.

  5. If it is not configured, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Security & Privacy.

  4. In the Authentication and User Provisioning section, select Configure in the SAML row.

  5. Follow the walkthrough to connect your identity provider.

  6. Sign out, then sign back in with SAML SSO to confirm it works.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Security & Privacy.

  4. In the SAML row, remove the SAML configuration.

Reference