---
locale: "en"
updated_at: "2025-10-27T22:49:27.543Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/sso/configure-the-applications/slack"
---

# Configure Slack for UserLock Single Sign-On (SSO)

Configure SSO login for Slack through UserLock.

## Introduction

This guide explains how to integrate **Slack** with **UserLock Single Sign-On (SSO)** using the **SAML 2.0** protocol.

Once configured, Slack logins are authenticated by **UserLock** against **Active Directory**, allowing administrators to enforce UserLock [access policies](/userlock/docs/reference/core-concepts/access-policies) (MFA, time, machine, or location restrictions) on SSO sessions.

🚩 **Before starting:**

- You need a **Slack Plus** plan — SSO via SAML is not available on the Free or Pro plans.
- **UserLock SSO** must already be [installed and configured](/userlock/docs/guides/sso/install-configure-sso).

## Step 1. Enable Slack in UserLock SSO

1. In the **UserLock console**, go to ⚙ **Server settings ▸ Single Sign-On**.
2. In the list of applications, select **Slack**.
3. Fill in the fields with the following values:
  | Settings | Values |
  | --- | --- |
  | Application Domain | `https://<yourWorkspace>.slack.com`  *(your Slack workspace domain)* |
  | Email domain | Domain used by users to authenticate (e.g. contoso.com) |
4. Save the profile.

![](https://a.storyblok.com/f/122374/650x770/6f6f2f5c6a/slack_settings.PNG)

## Step 2. Configure Slack for Single Sign-On

1. Log in to your **Slack workspace** with an **administrator** or **workspace owner** account.
2. Go to **Administration ▸ Settings and Permissions**.
3. In the **Authentication** section, click **Configure** next to **SAML authentication**.
  ![](https://a.storyblok.com/f/122374/605x510/3627125780/slack-saml-authentication.png)
4. Complete the SAML configuration form using the following values:
  | Field | Value |
  | --- | --- |
  | SAML 2.0 Endpoint (HTTP) | `https://<SSO_address>/saml/sso` |
  | Identity Provider Issuer | `https://<SSO_address>` |
  | Public Certificate | 1. Go to *UserLock console▸ *⚙ *Server Settings▸ Single Sign-On* 2. Click on *Download ▸ SAML certificate*. 3. Open it in a text editor, and paste the contents here (including `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----`). |
  ![](https://a.storyblok.com/f/122374/585x953/2199422c74/slack-saml-configuration.png)
5. In the **Configure SAML Authentication** section, switch from **Configure** to **Test** mode.
  ![](https://a.storyblok.com/f/122374/604x64/6cbddaf20f/slack-saml-test-1.png)
  
  ![](https://a.storyblok.com/f/122374/605x64/ac878d6094/slack-saml-test-2.png)
6. Scroll to the **Test and Save** section and click **Test Configuration**.
  ![](https://a.storyblok.com/f/122374/464x203/6e76bd5afc/slack-saml-test-3.png)
  When the test is successful, Slack displays a confirmation message similar to:
  ![](https://a.storyblok.com/f/122374/606x129/4825241dae/slack-saml-test-4.png)
7. Click **Save Configuration** to apply the SSO setup.

## Troubleshooting

For common issues, see [Troubleshooting SSO](/userlock/docs/support/troubleshooting/sso-issues).
If the problem persists, please contact [IS Decisions Support](/support).

### Handling SSO unavailability  

If SSO authentication fails or becomes unavailable, only the **workspace owner** can disable SSO temporarily.

Ask your workspace owner to **deactivate SSO** from **Settings and Permissions ▸ Authentication ▸ SAML Authentication** while troubleshooting the issue.

## Next steps

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

- [Apply MFA on SaaS connections](/userlock/docs/guides/mfa-implementation/mfa-for-sso) to require stronger authentication.
- [Hour restrictions](/userlock/docs/reference/access-policies/time-restriction): define when users are allowed to connect.
- [Geolocation rules](/userlock/docs/reference/access-policies/geolocation): enforce access policies based on user location.
- [Session limits](/userlock/docs/reference/access-policies/session-limit): allow or deny SaaS logins entirely for specific users.