How to enable single sign-on for your team

If you're an admin of a Dropbox team on Advanced, Business Plus, or Enterprise, you can turn on single sign-on (SSO) for your team. Single sign-on lets team members access Dropbox by logging in to a central identity provider, so they don't need a separate password.

How to turn on single sign-on

1. Go to your identity provider's site and follow the instructions to set up single sign-on.
   • Many identity providers offer preconfigured settings for Dropbox. If your identity provider isn't supported, you can configure your own identity provider solution for SSO.
2. Download a copy of the X.509 certificate and make a note of the log in URL, you’ll need both later.
3. Log in to dropbox.com using your admin credentials.
4. Click Admin console in the left sidebar.
5. Under Team, click Settings.
6. Click the Security tab.
7. Under Authentication, click the dropdown next to Single sign-on (SSO) and select either:
   • Optional (for testing): Your team can log in to Dropbox using SSO or their Dropbox password.
   • Required (for production): Team members must log in to Dropbox using SSO, and their Dropbox password will no longer work. Admins can still use their Dropbox admin credentials to log in.

Note: To turn off single sign-on, click the dropdown next to Single-sign on (SSO) and select Off.

8. Click Add next to Identity provider sign-in URL, enter the copied login URL, then click Done.
9. Click Add next to X.509 certificate.
10. Select your X.509 certificate from your hard drive and click Upload.
11. Click Save.

After you turn on single sign-on, you can share these instructions for the rest of your team.

All devices that are linked to Dropbox accounts will continue to work. Admins can't reset passwords through Dropbox or require two-factor authentication since passwords and log in-related security are now managed by your identity provider.

How to find your team’s custom SSO sign-in URL

If team members have already logged in to your identity provider, they can go directly to their Dropbox account using the custom link.
To find your team’s custom SSO sign-in URL:

1. Log in to dropbox.com using your admin credentials.
2. Click Admin console in the left sidebar.
3. Click Settings.
4. Click the Security tab.
5. Under Authentication, go to SSO sign-in URL and click Copy link.

Seeing a SAML assertion error when you log in?

Learn how to resolve the error message: “Could not validate SAML assertion.”