Skip to main content
Org admins control how users get into the Organization. Three access modes are available, and they can be combined.

​
Access modes

SSO only — Users must authenticate through a configured identity provider. Ad-hoc email invitations are disabled. Supported providers: Okta, Auth0, Azure Active Directory, Google Workspace, Duo. Ad-hoc invitations only — Users are invited by email. No SSO required. SSO + ad-hoc — Both methods work simultaneously. Users can join via SSO or by accepting an email invitation.

​
Configure SSO

Only org admins can configure SSO. To set up an identity provider:
  1. Go to Settings → Access in the console.
  2. Under SSO, select your identity provider.
  3. Follow the provider-specific setup steps below.
  4. Click Save.

​
Okta

  1. In Okta, create a new SAML 2.0 application.
  2. Set the SSO URL and Audience URI to the values shown in the Runpod console.
  3. Copy the Identity Provider metadata URL from Okta and paste it into the Runpod console.

​
Auth0

  1. In Auth0, create a new SAML application.
  2. Set the callback URL to the value shown in the Runpod console.
  3. Copy the Auth0 domain and client ID into the Runpod console.

​
Azure Active Directory

  1. In Azure AD, register a new enterprise application.
  2. Set the reply URL (Assertion Consumer Service URL) to the value shown in the Runpod console.
  3. Copy the Azure AD tenant ID and application ID into the Runpod console.

​
Google Workspace

  1. In Google Workspace Admin, create a new SAML app.
  2. Set the ACS URL and Entity ID to the values shown in the Runpod console.
  3. Download the Google IdP metadata and upload it in the Runpod console.

​
Duo

  1. In Duo, create a new SAML application.
  2. Configure the entity ID and ACS URL using the values shown in the Runpod console.
  3. Copy the Duo metadata URL into the Runpod console.

​
Email domain allowlist

When ad-hoc invitations are enabled, you can restrict membership to users with approved email domains (e.g. acme.com).
Public email providers (gmail.com, yahoo.com, outlook.com, hey.com) cannot be added as approved domains. The console will show a warning if you attempt this.
To configure the domain allowlist:
  1. Go to Settings → Access.
  2. Under Approved domains, enter one or more domains.
  3. Click Save.
Only users with email addresses matching an approved domain can accept invitations.

​
IP allowlist

Org admins can restrict console and API access to specific IP ranges using CIDR notation. When the allowlist is non-empty, any request from an IP not on the list is blocked with HTTP 403.
Before saving an IP allowlist, ensure your own IP address is included. The console warns you if your current IP is not covered to prevent locking yourself out. Changes take effect within 60 seconds.
To configure the IP allowlist:
  1. Go to Settings → Access.
  2. Under IP Allowlist, add one or more CIDR ranges (e.g. 203.0.113.0/24).
  3. Click Save.
To remove the IP restriction entirely, delete all entries and save.