SAML single sign-on (SSO) overview
Single sign-on (SSO) lets your team log in to Calendly using their existing company credentials, managed by your company’s identity provider (IdP) — the service that stores and authenticates user accounts (such as Okta, Microsoft Entra ID, or OneLogin). Calendly’s SSO uses Security Assertion Markup Language (SAML) 2.0, an industry-standard authentication protocol.
With SAML SSO enabled, your team can:
- Sign in to Calendly through your company’s IdP using one set of credentials.
- Avoid managing separate Calendly passwords.
What SSO features does Calendly support?
Supported SSO features
- Service Provider Initiated SSO (SP-initiated): Users go to calendly.com and log in through your company’s IdP. (“Service Provider” refers to Calendly in this flow.)
- Identity Provider Initiated SSO (IdP-initiated): Users start from your IdP dashboard and select Calendly to log in.
What’s not supported
- Just-in-Time (JIT) provisioning is not supported. To manage users automatically, use System for Cross-domain Identity Management (SCIM).
Which identity providers does Calendly SSO support?
Calendly SSO supports any identity provider (IdP) that uses SAML 2.0. Calendly has tested and documented setup steps for these IdPs:
For other identity providers, follow the steps in How to set up SAML SSO with your identity provider.
What are the requirements to set up SSO?
To set up SAML SSO for Calendly, you must:
- Be on the Teams plan with the SSO add-on or the Enterprise plan.
- Be a Calendly Owner or Admin.
- Work with your IT admin, who will manage the IdP-side setup.
Other notes about SSO setup:
- Calendar and integration settings won’t change when SSO is enabled.
- The session timeout is 21 days by default. Owners and Admins can shorten this in Settings → Access → Single sign on.
- Multi-factor authentication (MFA) is configured in your identity provider (IdP), not in Calendly.
- If your company has more than one Calendly organization, you’ll need to set up SSO for each organization separately.
- Don’t enable SSO if you have Calendly users who aren’t in your identity provider (IdP) — those users won’t be able to log in.
What happens when SSO is enabled?
Once SAML SSO is turned on:
- All users are signed out of Calendly.
- Users must log in again using their identity provider (IdP) credentials.
Owners and Admins can still select Log in using another method to access their Calendly account directly. This option is helpful for disabling SSO or troubleshooting IdP issues.
How to notify your team before enabling SSO
Before enabling SAML SSO, send an email to your team to let them know about the change. You can use the template below — replace the bracketed placeholders with your organization’s information.
How to manage users with SSO enabled
Owners and Admins manage users with SAML SSO using the steps below.
How to add new users with SSO enabled
- Add the user in your identity provider (IdP) and in Calendly.
- Users must accept their Calendly invite before logging in with SSO.
How to remove users with SSO enabled (without SCIM)
If you don’t have SCIM enabled, removing a user with SSO enabled requires action in both systems:
- Remove the user from your identity provider (IdP) and from Calendly.
- Removed users will revert to a Calendly Free plan account.
- Removed users will sign in using their original sign-in method (for example, Google OAuth — signing in with a Google account).
- To automate user removal, enable SCIM.
How to change a user’s email with SSO enabled
- Update the user’s email in your identity provider (IdP).
- Then contact Calendly Support with the new email address to update the Calendly account.