Skip to main content
LyricDocs
Contact support Open LyricOS

Administer

Authentication and single sign-on

Administrators can require two-factor authentication for everyone in the organization, and can set up single sign-on so that people sign in through the organization's identity provider. Single sign-on is included with Lyric Teams and Lyric Enterprise.

Two-factor authentication

In Settings › Organization (Settings › Team on Lyric Teams) › Authentication, administrators can require two-factor authentication for everyone. People who have not set it up are asked to do so at their next sign-in, and Users shows anyone without it as Two-factor off. Where single sign-on is required, the identity provider's own sign-in checks apply instead.

Single sign-on

LyricOS supports single sign-on with OpenID Connect and SAML 2.0, including Okta, Microsoft Entra ID, Google Workspace and other identity providers that support either protocol.

Setting up single sign-on

  1. In Settings › Organization (Settings › Team on Lyric Teams) › Authentication, select Set up single sign-on.
  2. Choose your identity provider and protocol. OpenID Connect is recommended where your provider supports it.
  3. Add Lyric to your identity provider using the values LyricOS displays, such as the redirect address or the assertion consumer service address.
  4. Enter your provider's details: for OpenID Connect, the issuer, client ID and client secret; for SAML 2.0, the sign-in address, identifier and signing certificate.
  5. Verify each email domain your organization uses by adding the DNS TXT record LyricOS displays.
  6. Test the connection, then turn on single sign-on.

Requiring single sign-on

When single sign-on is required, everyone in the organization signs in through the identity provider, and password sign-in is turned off for them.

Who can sign in

Single sign-on does not create accounts. Only people who have been invited to the organization and hold a seat can sign in through it.

Recovery codes

Administrators receive recovery codes when single sign-on is turned on. Each code can be used once to sign in if the identity provider is unavailable. Store them securely.

Turning off single sign-on

Turning off single sign-on restores password sign-in for the organization's people.

Last updated October 28, 2026