Learn how your enterprise organization can use your Identity Provider to manage Expo users on your team.
SSO is available for Enterprise plan customers. To get started, contact us and we'll help you set it up for your organization. You can also start preparing your identity provider for Expo SSO by following the configuration guides below.
Expo SSO supports the following identity providers:
| Identity providers | Resources |
|---|---|
| Okta | Configuration guide |
| OneLogin | Configuration guide |
| Microsoft Entra ID | Configuration guide |
We implement the OpenID Connect Discovery 1.0 specification and are working to verify additional compatible identity providers. If you use another identity provider and are interested in SSO, let us know.
1
Navigate to expo.dev/sso-login and enter the account name of your
organization. You can create a link that pre-fills the organization name. For example,
expo.dev/sso-login/test-org pre-fills test-org.
2
Log in to your identity provider (IdP).
3
Next, you'll be prompted to select an Expo username. This will be the username for your Expo account.
Available with SDK 50 and above. For previous versions, the Expo CLI will use your SSO account after logging in via the EAS CLI.
When using the Expo CLI, you can run the following command to log in to your Expo account.
-Â npx expo login --ssoYou will be prompted to log in via the Expo website in a browser and will be redirected back to the CLI upon completion.
When using the EAS CLI, you can run the following command to log in to your Expo account.
-Â eas login --ssoYou will be prompted to log in via the Expo website in a browser and will be redirected back to the CLI upon completion.
1
Click the Continue with SSO button on the sign-in page when going through the sign-in flow.
2
SSO users are like regular users. However, there are a few known exceptions:
Both new organizations and existing organizations can enable SSO as a sign in option. Organizations with existing non-SSO members can enable SSO and then direct new members to the SSO sign-in page, while existing users continue to use their current Expo credentials. To support external contributors, SSO-enabled organizations also allow inviting additional non-SSO users via email.
Regular users may be a member of one or many personal, team, and organization accounts while SSO users belong exclusively to their organization account. Thus, existing users cannot be directly converted into SSO users. However, a regular user who's already a member of your organization may create a second user by going to the SSO login page. Then, their regular user can be removed from the organization.
To transition from using a regular Expo account to an SSO account, follow these steps:
1
Check if you're already logged in at expo.dev. If so, log out.
2
Go to the SSO login page and follow the prompts, such as entering your organization name, creating a new Expo username, and logging in to your identity provider.
3
By default, your new SSO user will have the View Only role. If you need a different role, ask an Admin or Owner to update your role in member settings.
4
eas login --sso to switch to your new account on the CLI.5
At this time, the Admin or Owner can remove your old user from the organization. In member settings, the list of organization members indicates whether a user is an SSO or non-SSO user. The Admin or Owner can click the dropdown next to the old user and click Remove member.
6
If you no longer need your old user account, log out of your new SSO account, then log in to your old account and go to user settings. Scroll down and click Delete Account. Note that this will delete any projects under your old user account. It will not affect any projects owned by the organization.
If you wish to reuse your old username on your new SSO user account, you can go to user settings under your old user and rename it before creating your SSO account. Alternatively, you can rename your SSO user account's Expo username after deleting your old user. While Expo usernames need to be unique, it is OK if your email address on your identity provider matches the email address of your old user.
If someone has left your organization, remove or disable them in your IdP. Depending on the token refresh duration you configured with your IdP, the removed user will subsequently lose access to their Expo account. If you wish to remove them ahead of that time or you wish to remove them to clean up users on your account, you may do so on the organization member settings page:
1
Navigate to your organization account member settings.
2
Click the dropdown next to the member you wish to delete, and click Delete SSO user.
This will delete their personal account and all data associated with it. All data in your organization account will remain unaffected.
An active Enterprise Plan is required to continue using SSO. Contact us if you wish to discontinue the use of SSO or change your plan.
To ensure uninterrupted access to your organization whether or not SSO is enabled, SSO organizations must keep at least one non-SSO user with the Owner role as a member.
Once SSO is configured for an organization, account deletion must be done manually by the Expo team. Contact us for assistance.