⭐️ This is available only for workspaces on Enterprise plans and Business workspaces with more than 30 paid seats. Find out more about Pitch plans and pricing. ⭐️

Once you’ve upgraded to the Enterprise plan or added 30 seats to the Business plan, we will turn on SSO for your team. After SSO has been enabled, an admin in your Pitch workspace will need to connect your account with WorkOS (the external SSO provider we use). To get started, visit the Workspace settings page where you'll now find a field to Manage single sign-on (SSO). Click the Manage SSO button to open WorkOS in a new window and begin your setup.

Once connected, you will enter self-service configuration on WorkOS. Select your identity provider (IdP), follow the on-page instructions and once completed, SSO will be activated for your workspace. All users in your Pitch workspace will only be able to use SSO as their login method from now on.

In order to complete the SSO sign-up process, a member of your IT team will need to connect your identity provider (IdP) using WorkOS. After opening the admin portal, you will be asked to select your IdP. Based on your selection, you'll see a set of instructions to complete your setup.

You can review configuration guides for Azure, Google, Okta, and other IdPs in the WorkOS guides. If you have any specific questions about WorkOS, you can contact their team at support@workos.com.

In May of 2024, we shipped substantial improvements to our SSO capability. The following are now possible:

If you have questions about this, or want to add additional domains or workspaces to your SSO set up, please reach out to the Pitch support team using the in-app messenger or by emailing support@pitch.com.

How do I purchase SSO for my team?

SSO is part of our Enterprise or Business plans with at least 30 seats. Please get in touch with our team to discuss pricing and enablement options. You can contact them through the Contact us option on our pricing page, or email the team at support@pitch.com.

Can I use other sign-in methods after SSO has been enabled?

Once SSO is enabled, users will only be able to sign into new or existing accounts through SSO. All previous sign-in methods (e.g, email and password) will not work going forward. SSO is configured on a domain — not a workspace — level, so users will need to sign in with SSO in order to access any workspace, even ones on the Starter plan or not affiliated with your company.
​

What happens to our data after enabling SSO?

All data is preserved and no data is modified except for adding the SSO configuration information. Once any user logs into a newly SSO-enabled workspace, they will have the same experience as before.

Can two SSO setups share the same domain?

A configuration (SSO setup via your IdP) can have multiple domains associated with it, and manage multiple Pitch workspaces. Additionally, one Pitch workspace can be a part of two or more SSO setups. However, it is not possible for the same domain to be associated with more than one SSO setup.
​

How do we modify our SSO setup?

You can configure and maintain your IdP connection using the admin panel in WorkOS. You can open the admin panel by navigating to your Workspace settings in Pitch and clicking on Manage SSO. It's not possible to manage your SSO connection directly in Pitch.

If you would like to add additional domains or workspaces to your setup, please reach out to us.
​

What if we want to disconnect SSO?

If you're interested in disconnecting SSO for your workspace, please contact our support team through the messenger in the app, or by emailing support@pitch.com.