# SAML SSO, SCIM and identity provider groups

*Slack Consultant Study Guide · Policies and Settings · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-consultant/policies-and-settings/saml-sso-scim-and-identity-provider-groups*

How to guide a client's identity setup: SAML SSO availability by plan and where it is configured, required attributes and how Slack matches accounts, guest exclusions and the owner bypass, JIT versus SCIM provisioning, profile sync pitfalls, IdP groups for workspaces and channels, and the HR and IT discovery questions that come first.

- Certification: Salesforce Slack Consultant
- Exam section: Policies and Settings
- Study guide: https://www.certifyforce.com/study-guide/slack-consultant

**Official exam objective:**

> Provide guidance and requisite setup of identity management settings in Slack.

## What the exam expects

- Recommend the plan and configuration level for SAML SSO (workspace on Business+, org on Enterprise; Free and Pro only with a connected Salesforce org).
- Choose the SSO requirement option when guests have no IdP accounts, and explain the owner bypass for IdP outages.
- Name the required SAML attributes and explain how Slack matches a sign-in to an account, including during an IdP change.
- Compare JIT and SCIM provisioning and diagnose SAML profile sync overwriting SCIM values.
- Connect IdP groups to workspaces and channels, and ask HR and IT the lifecycle and security questions before configuring anything.

Key terms:
- **SAML SSO**: sign-in through an identity provider (IdP) using SAML 2.0.
- **NameID**: the IdP's unique, pseudo-random identifier for a user that should not change over time.
- **JIT provisioning**: Slack creates the account at the user's first SSO sign-in.
- **SCIM provisioning**: the IdP creates, updates and deactivates Slack accounts ahead of sign-in through the SCIM API.
- **IdP group**: an IdP security group synced to Slack and connected to workspaces or channels.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| SAML SSO plans | Business+ and Enterprise; Free and Pro only with a connected Salesforce org | [Set up SAML SSO](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack) |
| Who enables SSO | Workspace Owner (below Enterprise); Org Owner (Enterprise) | [Set up SAML SSO](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack) |
| Required SAML attributes | NameID and email | [Optimize Authentication & SSO](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/implement-the-right-authentication-process) |
| Binding window after SSO is required | 72 hours | [Set up SAML SSO](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack) |
| Additional SSO configurations | Up to 11 | [Set up SAML SSO](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack) |
| SSO bypass | Workspace Owners and Org Owners, with email and password | [Set up SAML SSO](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack) |
| Default provisioning with SSO | JIT | [Maximize Access & Security](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/explore-access-and-security-controls) |
| SCIM billing | Billable at first sign-in | [SCIM provisioning](https://slack.com/help/articles/212572638-Manage-members-with-SCIM-provisioning) |
| Leaving an IdP group | Removes the person only from required workspaces | [IdP groups](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization) |

## Check yourself

- Why must email addresses stay the same when a client switches identity providers?
- When should SSO be required for all members excluding guests?
- Which two attributes must every SAML response include?
- What does SCIM add over JIT provisioning?

## Sources

- [Optimize Slack Authentication & SSO](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/implement-the-right-authentication-process)
- [Maximize Access & Security in Slack](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/explore-access-and-security-controls)
- [Improve IAM with Slack](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/get-started-with-slack-and-identity-management)
- [Set up SAML single sign-on for Slack](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack)
- [Manage single sign-on settings](https://slack.com/help/articles/220403548-Manage-single-sign-on-settings)
- [Manage members with SCIM provisioning](https://slack.com/help/articles/212572638-Manage-members-with-SCIM-provisioning)
- [Connect identity provider groups to your Enterprise organization](https://slack.com/help/articles/115001435788-Connect-identity-provider-groups-to-your-Enterprise-organization)
- [Slack plans and features](https://slack.com/help/articles/115003205446-Slack-plans-and-features)
- [Mandatory workspace two-factor authentication](https://slack.com/help/articles/212221668-Mandatory-workspace-two-factor-authentication)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Slack Consultant pack (USD $19): https://www.certifyforce.com/practice-exams