Skip to main content

​
Pre-requisites

  • Organization should be on Fillout’s Enterprise Plan
  • Your account must have an Admin role in your team
SAML is available on Fillout’s Enterprise Plan.

​
Set up SSO

After signing up or upgrading your plan, you will be sent setup instructions via WorkOS.

​
How to Log in Using SSO

Once SSO is configured, your team members can log in by clicking on Login with SSO on the Fillout login page and entering their company email. Screenshot 2025-11-06 at 6.26.47 PM.png

​
How provisioning users works

Fillout does not currently auto-provision users when they are added to your SSO provider. Instead, an account in Fillout will be created when the user logs into Fillout for the first time, using the SSO login.

​
Require an invitation to join

If you also use your SSO provider for a form login page, everyone you grant access to in your provider can create a Fillout account by signing in to the Fillout dashboard. Admins can turn that off, so that only the people you invite become members of your organization.
1

Open security settings

Click your Account name in the upper left corner, then Settings, then Security. In the Single sign-on section, expand Advanced.
2

Toggle Require an invitation to join

A confirmation dialog explains what changes.
3

Confirm

Click Require invitation. The change applies to your organization right away.
While the setting is on:
  • Signing in with SSO no longer creates a Fillout account. Someone without an account who tries to sign in to the Fillout dashboard is asked to contact their organization admin.
  • Access to your forms and apps is unchanged. Respondents sign in with SSO exactly as before, including pre-filled fields and custom attributes.
  • Existing members are unaffected, and continue to sign in with SSO.
  • Invitations still work. Invite someone as usual and they can accept and sign in with SSO.
Turning the setting on or off is recorded in your audit logs as a critical org.ssoRequireInvite event.
Anyone who became a member before you turned this on keeps their account. You can remove them if they should not have one.
Enforcing SSO Contact support@fillout.com if you would like to enforce SSO for all users on your account. By default, users added to your account before enabling SSO will still be able to authenticate with their prior authentication method (e.g., password or Google login). At your request, we can enforce SSO for all users going forward, including existing users. Existing users will still retain all their prior details once they log in with SSO.
SAML SSO can only be enforced for a team if your current session was authenticated via SAML SSO. This ensures your configuration works correctly before restricting team access, preventing accidental loss of access.
SSO on forms Fillout also supports adding SSO to your forms and pre-filling fields with employee information. Learn more here.