Using Login with SSO

If you have an email invitation to join the organization in your inbox, follow one of these procedures depending on whether you already have a Bitwarden account with that email address:

I already have a Bitwarden account

If the invitation is sent to an email that is already linked to a Bitwarden account and matches the email address supplied by the IdP, follow these steps to join the organization:

1. Click the Join Organization button in the email invitation.

2. On the Bitwarden invitation page, select Log in. Enter your email address, then master password, and select Log in once more.

3. Once you have successfully logged in, a green banner will appear at the top of the page, indicating that your organization invitation has been accepted. An organization admin will need to confirm you to the organization before you can proceed.

4. Once you're confirmed, you'll be able to access the organization by logging in to Bitwarden again, this time using the Enterprise single sign-on option.

I don't have a Bitwarden account

If the invitation is sent to an email that isn't already linked to a Bitwarden account, follow these steps:

1. Click the Join Organization button in the email invitation.

2. Select Log in on the invitation page, then enter your email address. On the following page, select the Enterprise single sign-on button.

3. Enter your SSO identifier and select Log in (if your email matches an organization's verified domain, you will bypass this step).

4. Log in to your IdP. Once you do, you'll be redirected to a page where you can create a master password for your new account.

5. Create a master password for the account. An organization admin will need to confirm you to the organization before you can proceed.

6. Once you're confirmed, you'll be able to access the organization by logging in to Bitwarden using the Enterprise single sign-on option.

If you receive the error message <email> has been invited to the organization, please accept invitation. while attempting to log in, there's already a Bitwarden account associated with this email. Please follow the I already have a Bitwarden account instructions above.

To login using SSO and your master password:

1. Open your Bitwarden web vault and enter your Bitwarden email and select Continue. If you don't have a Bitwarden account email yet, you may enter your company email.
   

   

2. Select the Enterprise single sign-on button:

   

3. Enter your SSO identifier and select Log In (Organizations with a verified domain will bypass this step):
   
   

   

   tip

   We recommend bookmarking this page with your organization identifier included as a query string so that you don't have to enter it each time, for example https://vault.bitwarden.com/#/sso?identifier=YOUR-ORG-ID or https://your.domain.com/#/sso?identifier=YOUR-ORG-ID.

4. Now that you have authenticated your identity using SSO, you will be prompted to either create a master password for your new account or, if you already have a Bitwarden account, to enter your master password to decrypt your vault.

   note

   Why is my master password still required?

   All vault data, including credentials shared by your organization, is kept by Bitwarden only in its encrypted form. This means that in order to use any of those credentials, you need a way to decrypt that data. We can't.

   Your master password is the source of that decryption key. Even though you are authenticating (proving your identity) to Bitwarden using SSO, you still need to use a decryption key (your master password) to unscramble vault data.

5. If you are using two-step login, authenticate using your secondary device.

   warning

   Two-step login via email is not recommended if you are using login with SSO, as using multiple methods will cause errors. Consider setting up two-step login via a free authenticator instead.