How to set up SSO for Proton Pass
- Reading
- 4 mins
- Categories
- Proton Pass for Business
- Proton Pass
Our Proton Pass Professional plan supports single sign-on (SSO), which allows you to securely log in to your Proton Pass account and multiple other accounts using a single password. In this article, we’ll show you how to set up SSO as an admin, manage it for your business or organization, and how staff members can use it.
Before you start, you’ll need the following:
- A Proton Pass Professional account with Admin privileges
- An account with admin access with an identity provider such as Okta, Microsoft Entra ID, OneLogin, etc.
Get Proton Pass Professional(new window)
How to set up SSO for Proton Pass using Google
How to set up SSO for Proton Pass using Microsoft
How to set up SSO for Proton Pass using Okta
How to set up SSO for Proton Pass
1. Log in to your Proton Pass admin panel and click Single sign-on → SAML authentication → Configure SAML.
2. Add your company domain name and click Add domain.
3. Verify the domain. To do this, log in to your domain provider’s web portal and enter the DNS TXT record displayed on this screen.
Click Continue once you’ve done this.
4. Import the SAML metadata for Proton Pass from your identity provider. You can import this data using a URL or XML file or by manually filling out Text fields. Select your preferred method (which may be determined by your IdP) and input or upload the requested data.
Click Continue when you’re done.
5. Provide the endpoints shown to your identity provider. If your IdP asks for an Assertion Consumer Service (ACS) URL and Issuer ID, simply copy and paste the information from this screen into your identity provider fields.
Once you’ve done this, click Done.
SSO should now be configured on your Proton Pass account. Click See details for an overview of your SSO settings.
How to manage SSO
Your organization’s users can now log in to Proton Pass apps using the username and password provided by your identity provider. To see the users who have joined your organization, log in to your Proton Pass account and go to Organization → Users. To add users to Proton Pass, log in to your identity provider. Note: SSO users will only appear here once they have signed in at least once.
You can manage an individual user’s SSO access using the dropdown menu in the Edit column next to their email address.
How to use SSO to sign in to Proton Pass
If an administrator for your organization has configured SSO for Proton Pass and enabled Proton Pass for your user account, you can sign in to Proton Pass apps using your IdP login. To do this, click or tap Sign in with SSO when you sign into a Proton Pass app.
Multi-domain SSO setup
Organizations can configure SSO for up to 5 domains within a single organization.
To access the multi-domain setup, log in to your Proton Pass account and go to Organization → Single sign-on.
Note: each domain requires its own SSO configuration, added separately in your organization settings. All domains must share identical SAML settings – any additional domains you add must match the configuration of the first.
Beyond SSO: Automate user management with SCIM
SSO verifies a user’s identity at login, but doesn’t sync new updates with Proton. When someone leaves your organization, changes teams, or loses admin rights, those updates have to be made manually and can leave access open if missed.
SCIM (System for Cross-domain Identity Management) closes that gap by keeping Proton continuously synced with your IdP. User changes are applied in Proton automatically, and creating SCIM groups lets you manage access for entire teams at once. That means if you add someone to a group in your IdP, they’ll automatically gain that group’s Proton access (such as to shared vaults, passwords, or VPN gateways); if you remove them, that access will be revoked automatically.
To set up SCIM for your organization, see: