Who can use this feature?
Plan: Call Center AI
Managed from: Admin Portal
Summary: Krisp SSO is based on SAML 2.0, with Krisp as the Service Provider, so it works with Okta, Microsoft Entra ID, JumpCloud, Google Workspace, and any other SAML 2.0 provider. Users are provisioned automatically: when a SAML response arrives for an email Krisp does not recognize, it creates the user and assigns an unassigned seat, and rejects the sign-in if no seat is free. SSO must be activated for your account first, after which you enable it under Security >>> Authentication, optionally enforce it as the only sign-in method, and complete the SAML configuration with the Audience URI, sign-on URL, issuer, and X.509 certificate from your IdP. Provider-specific guides are available for single teams and Organizations. Team members then sign in with the team slug or their company email, and Admins can change the slug later through key.config or an MSI parameter.
Overview
Single sign-on (SSO) lets you log in to Krisp using your company credentials. Krisp's SSO is based on SAML 2.0.
Krisp acts as the Service Provider (SP) and offers automatic user provisioning, so team members don't need to register with Krisp in advance. When Krisp receives a SAML response from the Identity Provider (IdP), it checks whether a user with the received email address already exists in the Krisp team account. If the user does not exist, Krisp creates one automatically with that email and assigns it to an available unassigned seat in the team. If there is no unassigned seat at the time of the user's first sign-in, the sign-in attempt is rejected.
Because Krisp implements the generic SAML protocol, it is compatible with a wide range of Identity Provider services, including Okta, Microsoft Entra ID, JumpCloud, Google Workspace, and any other service that supports SAML 2.0. For step-by-step instructions for your provider, see Setup guides by identity provider.
General instructions for team Admins
To start the SSO setup, it must first be activated for your team account. Once it is activated, follow the steps below:
- Go to your Admin Portal on account.krisp.ai.
- Go to the Authentication section from the Security tab.
- Enable SSO.
If you select the Enforce SSO checkbox, SSO becomes the only sign-in option for your team members. See this article for more about the Enforce SSO option.
To complete the SSO configuration:
- Configure your IdP to send the email address of your team member to Krisp as an identifier for the account.
- In your Admin Portal, where SSO is enabled, click SAML and enter the information from your IdP in the Configure SAML panel.
-
Enter the following information from your IdP in the Configure SAML panel of the Krisp Admin Portal:
- Audience URI
- Identity Provider Single Sign-On URL
- Identity Provider Issuer
- X.509 certificate.
Once all the information is entered, click Configure.
Now you and your team members can sign in with SSO using your team slug and your company IdP credentials.
Info
Your team slug matches your company domain name if you use your company email and that slug is not already in use by another team. Otherwise, it is generated randomly.
All team members can also sign in with your company email, since the company domain is detected automatically. See this article for more information.
Setup guides by identity provider
Setup steps differ depending on whether you manage a single team or an Organization with multiple teams. Organization Admins can set one Org-level SSO policy that applies to the teams below them, instead of configuring SSO for each team separately. If you manage several teams from one place in the Admin Portal, use the Organization guide. Learn more about Organizations in Krisp.
Important
Enabling Org-level SSO automatically turns off team-level SSO for the teams mapped to it.
| Identity provider | Single team | Organization |
|---|---|---|
| Okta | SSO and SCIM for a single team | SSO and SCIM for Organizations |
| Microsoft Entra ID | SSO and SCIM for a single team | SSO and SCIM for Organizations |
| JumpCloud | SSO and SCIM for a single team | SSO and SCIM for Organizations |
| Google Workspace | SSO for single teams and Organizations (SCIM is not supported) | |
Using a different provider? Any identity provider that supports SAML 2.0 works with Krisp SSO. Follow the general instructions for Admins above.
Change the in-app SSO slug after installation
To learn more about deploying Krisp for SSO-enabled teams, see this article.
As an Admin, once you update the SSO slug from the Admin Portal, you can change it in the app as well by using one of these options:
-
Change from the JSON body
Open the key.config file in the ProgramFiles/Krisp folder and change the sso_slug property in the JSON body. -
Change via a repair MSI action using a different sso_slug
Run the same MSI installer with the new slug as a parameter. It overrides the sso_slug value in key.config. -
Change during an update
When installing the new version, specify a new sso_slug value in the installer parameter, and the value is overridden during the update.