--- title: "Adding or Inviting Enterprise SSO users - Document360" slug: "inviting-or-adding-sso-users" description: "After successfully configuring the Enterprise SSO with your project, you can start inviting previously added users or adding new users as SSO users.It is almost similar to, with just one variation." tags: ["SSO"] updated: 2026-10-21T07:14:37Z published: 2026-10-21T07:14:37Z canonical: "docs.document360.com/inviting-or-adding-sso-users" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.document360.com/llms.txt > Use this file to discover all available pages before exploring further. # Inviting or Adding SSO users After you set up Single Sign-On (SSO) with SAML or OpenID Connect, you can give people SSO access to your project. Add new people as SSO users, convert existing Document360 accounts to SSO, and delete SSO users you no longer need. SSO users sign in with their credentials from your identity provider (IdP), such as Okta, Microsoft Entra ID or Google Workspace, instead of a Document360 password. --- ## When to add or convert SSO users Choose the task that matches the person's current status in your project: Add a new SSO user The person doesn't have an account in your project yet. Add them as an SSO user so they sign in through your IdP from their first sign-in. [Add a new SSO user](/docs/inviting-or-adding-sso-users#how-to-add-a-new-sso-user) Convert existing accounts to SSO The person already has a Document360 account. Convert that account to SSO. Document360 doesn't create a second account. [Convert existing accounts to SSO](/docs/inviting-or-adding-sso-users#how-to-convert-existing-accounts-to-sso) Delete an SSO user The person no longer needs access to your project. Delete their SSO user account. [Delete an SSO user](/docs/inviting-or-adding-sso-users#how-to-delete-an-sso-user) You can convert existing accounts in two places: - **In the SSO configuration**: Use the **More settings** tab to convert all existing accounts, or a selection of them, in one step. Use this when you move your whole project to SSO. - **In the Users or Readers list**: Select specific accounts and convert them. Use this to convert people one at a time or in small batches. To learn how, read [Convert user to SSO](/docs/convert-user-to-sso) and [Convert reader to SSO](/docs/convert-reader-to-sso). --- ## Before you begin - SSO is already configured for your project with SAML or OpenID Connect. - You have the **Owner** or **Admin** project role, or a custom role with the **Manage users** permission. - The email address of each new SSO user matches the domain specified in the SSO configuration. --- ## How to add a new SSO user You add an SSO user the same way you add a standard user, with one extra step to choose the SSO configuration. 1. Go to **Settings** () > **Users & Permissions** > **Users & groups**. 2. In the **Users** tab, click **Add** > **User**. 3. In the **New user** dialog, enter the email address of the user in the **Email** field. You can enter up to five email addresses, separated by commas. 4. Select the **SSO user** checkbox. 5. In the **Select SSO** dropdown, select the SSO configuration you want the user to sign in with. 6. If you don't want to send an invitation email, select the **Skip invitation mail** checkbox. 7. Choose the **Project role** for the user. 8. Select the **Content role** and the level of content access. 9. (Optional) In the **Assign groups** dropdown, select a user group. 10. Click **New user**. A success notification confirms that the user is added. The user appears in the **Users** list with an **SSO** badge. Unless you skipped the invitation, the user receives an invitation email with their login details. For details on project roles, content roles and content access, read [Add new user](/docs/add-new-user). To add an SSO reader instead, read [Add readers](/docs/add-reader). **Next step**: Ask the user to sign in with SSO. To learn how, read [Log in using SSO - Knowledge base portal](/docs/login-using-sso-knowledge-base-portal). --- ## How to convert existing accounts to SSO Use the SSO configuration to convert existing user and reader accounts to SSO. Document360 switches each selected account to SSO sign-in. It doesn't create a second account, and the original password sign-in doesn't stay active. 1. Go to **Settings** () > **Users & Permissions** > **Enterprise SSO**. 2. Hover over the SSO configuration you want people to use and click the **Edit** () icon. 3. In the SSO configuration window, go to the **More settings** tab. 4. Turn on the **Convert existing team and reader accounts to SSO** toggle. 5. Under **Send invite to**, select one of the following options: - **All users**: Includes everyone currently added to the project. - **Selected users**: Opens a list of people in the project. Select the checkbox next to each person you want to convert. 6. Click **Update**. ![More settings tab of an SSO configuration with the option to convert existing accounts to SSO and choose who receives the invite.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/SSO_configuration_more_settings.png) The selected accounts are converted to SSO. Each person receives an invitation email with their SSO login details and, from then on, signs in through your IdP. **Next step**: Tell the converted people that their sign-in method has changed, and ask them to sign in with SSO. --- ## How to delete an SSO user Delete an SSO user when the person no longer needs access to your project. Deletion is permanent. 1. Go to **Settings** () > **Users & Permissions** > **Users & groups**. 2. In the **Users** tab, select the checkbox next to the SSO user you want to delete. SSO users show an **SSO** badge. ![Users list with an SSO user selected and the Deactivate option at the top of the list.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Delete_sso_user.png) 1. Click **Deactivate** at the top of the list. The **Confirm user deactivation** panel appears. 2. Select **Delete user** and click **Delete**. ![Confirm user deactivation panel with the Delete user option selected and the Delete button.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/delete-sso-user-confirmation.png) The user is removed from the project. To suspend access without deleting the account, deactivate the user instead. To learn more, read [Deactivate or delete user](/docs/deactivate-delete-user). --- ## Considerations | Limit | Detail | | --- | --- | | Users per add | You can add up to five users at a time in the **New user** dialog. To add more, use [Import users](/docs/import-users). | | One account type per email | The same email address can't belong to both a user and a reader in a project. To give an existing reader portal access, convert the reader to a user instead of adding them again. | | Accounts already on SSO | Accounts that already use SSO can't be converted again. | | Authorship after conversion | When you convert a user from the **Users** list, their past article contributions are credited to **Anonymous**. To learn more, read [Convert user to SSO](/docs/convert-user-to-sso). | --- ## Best practices - Use **Selected users** instead of **All users** when your project has people who should keep signing in with a Document360 password. - Convert a small group first and confirm they can sign in with SSO before you convert everyone else. - Tell people before you convert their accounts, so the change in sign-in method doesn't surprise them. - Add new people as SSO users from the start, so you don't need to convert their accounts later. --- ## Related articles - [Add new user](/docs/add-new-user) - [Add readers](/docs/add-reader) - [Convert user to SSO](/docs/convert-user-to-sso) - [Convert reader to SSO](/docs/convert-reader-to-sso) - [Deactivate or delete user](/docs/deactivate-delete-user) - [Managing SSO readers and reader groups](/docs/auto-assign-reader-group) - [Log in using SSO - Knowledge base portal](/docs/login-using-sso-knowledge-base-portal) --- ## FAQ **Does converting an existing account to SSO create a second account?** No. Document360 converts the existing account to SSO. The person keeps one account and signs in through your IdP instead of with a Document360 password. **Why can't I add someone as an SSO user?** The email address usually already exists in the project, for example as a reader, an SSO reader, a reviewer or another user. You can't add the same email address again. Check **Readers & groups** and **Users & groups** for the email address. If the person is a reader and needs portal access, convert the reader to a user instead.