> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://help.sigmacomputing.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server.

# Configure OAuth authentication for your Sigma organization

> Configure OAuth single sign-on (SSO) so users authenticate to your Sigma organization through your IdP.

This document guides you through configuring Sigma to authenticate users to your Sigma organization through OAuth single sign-on (SSO).

> **Note**
>
> This is a premium feature. To enable it for your Sigma organization, contact your Sigma Account Executive.

## Prerequisite

* You must have already configured a Sigma OAuth application in your IdP. If you have not yet completed this prerequisite step, see [Configure a Sigma OAuth application](/docs/configure-a-sigma-oauth-application). If you plan to use Databricks OAuth U2M as your IdP, see [Configure an OAuth application for Databricks](/docs/configure-an-oauth-application-for-databricks) instead.
* You must know the client ID, client secret, and metadata URI for your OAuth application:

  * Client ID and client secret:

    * If you're using an external IdP, you obtained these as part of this step: [Step 1: Create an app for Sigma in your IdP](/docs/configure-a-sigma-oauth-application#step-1-create-an-app-for-sigma-in-your-idp).
    * If you're using Databricks as your IdP, you obtained these values as part of this step: [Configure an OAuth application for Databricks](/docs/configure-an-oauth-application-for-databricks#step-2-configure-relevant-oauth-options).

  * Metadata URI:

    * If you're using an external IdP, you obtained this value as part of this step: [Step 3: Create an OAuth authorization server](/docs/configure-a-sigma-oauth-application#step-3-create-an-oauth-authorization-server).
    * If you're using Databricks as your IdP, you obtained this value as part of this step: [Determine your metadata URI for Databricks OAuth for users](/docs/configure-an-oauth-application-for-databricks#determine-your-metadata-uri-for-databricks-oauth-for-users).

## Requirements

* You must be assigned the Admin [account type](/docs/account-type-and-license-overview) to manage authentication for your Sigma organization.

## Configure OAuth as an authentication method for your Sigma organization

In Sigma, configure your organization to use OAuth as an authentication method.

> **Tip**
>
> When transitioning authentication methods for your Sigma organization from basic authentication to OAuth, the best practice is to transition first to the **OAuth or password** option instead of immediately requiring OAuth-only authentication for all users.
>
> With the authentication method set to **OAuth or password**, you keep the ability to sign in with a password during the transition to your IdP-based authentication, ensuring that you're not locked out during the configuration change.
>
> After you have confirmed that users are able to sign in using OAuth, you can transition to OAuth-only authentication.

To configure your Sigma organization to use OAuth as the authentication method:

1. Go to **Administration > Authentication**.

2. Add OAuth as an authentication method:

   * If your organization only has 1 identity provider, in the **Authentication** section, select **Edit**.
   * If your organization has [multiple identity providers (IdPs)](/docs/using-multiple-identity-providers-for-your-sigma-organization), in the **Authentication** section, select **+ Add authentication method**.

3. Configure your OAuth authentication method:

   * In the **Metadata URI** field, enter the OAuth metadata URI.
   * For **OAuth provider**, choose one of the supported providers. If no provider is selected and you are not using a custom domain, your IdP will be automatically detected.

     > **Warning**
     >
     > If you are using a custom domain, selecting an **OAuth provider** is required.
   * In the **Client ID** field, enter the client ID from your OAuth application.
   * In the **Client secret** field, enter the client secret from your OAuth application. After you enter and save this value, Sigma does not display it.
   * (For organizations with multiple IdPs enabled) Enter a **Name** for your OAuth authentication method. This name is displayed to all users when they sign in to Sigma.

4. (Optional) Configure additional authentication options:

   * (Optional) To enable guest user accounts, turn on the **Allow guest access** toggle. See [Guest User Accounts](/docs/guest-user-accounts).
   * (Optional) To customize how frequently users are prompted to sign in, set a **Session length in hours**. This setting only applies to users signing in with SAML or a password.
   * (Optional) To ensure users are automatically logged out after a certain length of inactivity in the product, turn on the **Enforce inactivity timeouts** toggle. See [Set up inactivity timeouts](/docs/set-up-inactivity-timeouts).

5. Test your OAuth configuration by signing out and signing back in to Sigma.

   If your configuration was successful, your organization sign in page displays the new authentication method, either with a **Log in with SSO** prompt or the **Name** you set for your authentication method.

   If your configuration was not successful, review the steps or contact [Sigma Support](/docs/sigma-support).

6. If you set an additional password-based authentication option and want to remove it after testing to ensure users are able to sign in using OAuth:

   * For organizations with 1 IdP, modify your selection in the **Authentication method** dropdown to choose the **OAuth** option.
   * For organizations with multiple IdPs enabled, delete the password authentication option. Next to the **Password** authentication option, select **Delete**, then select **Delete** again.

If your organization has [multiple identity providers](/docs/using-multiple-identity-providers-for-your-sigma-organization) enabled and you want to set up multiple OAuth authentication methods, repeat this process for each OAuth authentication method.

## Related resources

* [About using OAuth with Sigma](/docs/configure-oauth)
* [Configure a Sigma OAuth application](/docs/configure-a-sigma-oauth-application)