SSO
Let your team sign in to Hull through your company's identity provider
On Enterprise, your team can sign in to Hull through your identity provider, such as Okta, Microsoft Entra ID or Google Workspace. Hull uses WorkOS to connect to your provider. SSO and user provisioning are part of the Enterprise plan. See Plans.
Before you begin
- An Enterprise organization in Hull.
- The Owner role in that organization.
- Admin access to your identity provider.
Set up SSO
Request SSO
Open the Organization page at app.withhull.com. In the Single Sign-On card, click Set up SSO and send the request. You can also email sales@withhull.com. The Hull team enables SSO for your organization and follows up with you.
Verify your domain
When SSO is enabled, the card shows your email domain. Click Verify to open the WorkOS admin portal and prove you own the domain.
Connect your identity provider
Once the domain shows Domain Verified, click Complete setup. In the WorkOS portal:
- Add your identity provider's metadata to WorkOS.
- Copy the service provider details from WorkOS (such as the entity ID and ACS URL) into your identity provider.
- Set user provisioning and domain policies to match how your company manages access.
Set the domain policy last
If you enforce a domain policy before the SSO connection works, people on that domain may be locked out of Hull.
When setup is done, the card shows SSO Configured.
After SSO is on
- People with an email on your verified domain sign in through your identity provider. Sign-in starts at app.withhull.com.
- You can still invite people from the Organization page. See Members and roles.
- Sign-ins, automatic provisioning and domain changes appear in Audit logs.
- Sub-organizations use the parent organization's SSO.
To turn SSO off, contact support@withhull.com.