# Single sign-on
URL: https://docs.awellhealth.com/docs/administer-and-secure/single-sign-on

> For the complete documentation index, see [llms.txt](https://docs.awellhealth.com/llms.txt).



**Single sign-on (SSO)** lets an organization's people reach all of Awell's applications through
its own **identity provider**, or IdP.

## What SSO gives an organization [#what-sso-gives-an-organization]

Nobody has to create, remember or reuse a separate Awell password, so there's less password fatigue and
less of the risk that comes with it. Sign-in is controlled in the IdP the organization already uses.

Someone leaving the organization loses Awell access because they lost their IdP account, not because an
administrator remembered to remove them here.

## SAML is the protocol the guides here use [#saml-is-the-protocol-the-guides-here-use]

Awell supports the common SSO protocols. The provider guides in this section use
**Security Assertion Markup Language**, or SAML.

## Just-in-time provisioning creates the profile at first login [#just-in-time-provisioning-creates-the-profile-at-first-login]

With **just-in-time (JIT) provisioning**, a user profile is created in Awell the first time that person
signs in through the IdP, rather than being created in advance.

Onboarding becomes an IdP task: grant someone access to the Awell app in the IdP, and their Awell profile
appears at first login.

JIT creates the profile but doesn't decide which
[role](/docs/administer-and-secure/roles-and-permissions) it gets, so plan how new team members get the
right access.

## Next steps [#next-steps]

**Next:** [Set up SSO](/docs/administer-and-secure/set-up-sso) — the setup starts with a request to
Awell, not a settings page.