Skip to content
telemioDeveloper Docs
Open console
DOCUMENTATIONAuthentication · ReferenceBrowse integrations ↗
Docs/Authentication/Enterprise SSO planning
AUTHENTICATION · PLANNED

Enterprise SSO planning

An architecture guide for future company-identity federation—not a claim that customer SSO is available today.

AI-READY REFERENCE

Pass this guide to your agent

Short, page-specific instructions for an AI coding assistant.

Markdown ↗
Preview agent instructions 
# Telemio agent instructions — Enterprise SSO planning

Explain Telemio enterprise SSO as planned, not live. Telemio currently uses Cognito-backed direct sign-in and explicit workspace membership. A company email address, whether hosted by Gmail, Proton, or another provider, does not alone establish SAML/OIDC SSO. A future enterprise integration requires verified domain control, a configured SAML 2.0 or OIDC identity provider, registered Cognito federation, secure attribute mapping, correct redirects, and tests that prevent unauthorized workspace access. Do not auto-provision organization membership from email suffix alone.

Reference: https://telemio.sh/docs/authentication/enterprise-sso.html

Current availability

Not yet enabled for customer organizations. Telemio has a Cognito-based identity foundation and a design for verified-domain SAML/OIDC federation, but an organization identity-provider registration, user flow, and production access tests remain necessary. There is currently no self-service Entra ID or Okta SSO connection to activate.

Company email is not SSO

An employee can use an address such as employee@example.com for ordinary account registration or verification where the existing sign-in flow supports it. Receiving mail through Gmail or Proton does not automatically make that mailbox an enterprise SSO identity provider. SSO requires an actual identity provider that authenticates users through SAML or OIDC.

Federation architecture

For a supported customer provider, a Telemio administrator would verify the organization's domain and identity-provider ownership, configure the provider in the existing Cognito user pool, map stable user subject and verified email claims, then route company sign-in to the approved provider. Cognito supports federation with SAML 2.0 and OIDC providers, including Microsoft Entra ID and Okta. Provider configuration must precede any availability claim.

Security and access

Successful federation proves identity, not authorization to any Telemio workspace. Organization membership must be explicitly granted or provisioned under verified administrator policy. Domain conflicts, unverified claims, account-linking risks, and session/revocation behavior need testing. MFA policies should be agreed with the organization's identity administrator.

What an organization will need

When this feature launches, customers should expect to provide an organization administrator, a controlled email domain, a trusted SAML metadata document or OIDC issuer, suitable client configuration, approved attribute mappings, and access to a non-production test account. Nothing needs to be configured today for the existing Telemio login to keep working.

For current capabilities, see Authentication overview and MCP OAuth.