<div style="text-align: justify" class="support-note success primary">Note: The features in this article require different subscription levels. For more information about the features in each of our available plans, check out <a href="https://support.pipedrive.com/en/article/what-features-do-the-pipedrive-plans-have" target="_blank" rel="noreferrer noopener">this page. </a> </div>
Pipedrive offers numerous security-related features to give you full transparency of how and when your data is being accessed.
<hr>
<h2 style="text-align: justify">
<a name="permission-and-visibility-settings"></a>Permission and visibility settings</h2>
Permission sets
Users with account settings access can set up <a href="https://support.pipedrive.com/en/article/permission-sets" title="https://support.pipedrive.com/en/article/permission-sets">permission sets</a> to control what other users can do in Pipedrive, such as deleting deals or editing custom fields.
You can see the full list of actions that can be controlled via permission sets in <a href="https://support.pipedrive.com/en/article/permission-sets" title="https://support.pipedrive.com/en/article/permission-sets">this article.</a>
The number of visibility groups and default options you have also depends on the plan you are on.
<ul><li>Essential and Advanced plans One default group and two visibility options: item's owner or all users</li><li>Professional plans One default group plus three customizable visibility groups and four visibility options: item’s owner, item owner’s visibility group, item owner’s visibility group and sub-groups, or all users</li><li>Enterprise plans Unlimited amount of groups and four visibility options: item’s owner, item owner’s visibility group, item owner’s visibility group and sub-groups, or all users</li>
</ul>
 Visibility groups
<div class="support-note success primary">Note: You can purchase the <a href="https://support.pipedrive.com/article/booster-packs" target="_blank" rel="noreferrer noopener">team management booster pack</a> to add more visibility groups without upgrading your plan. </div>
While permission sets control what users can do in Pipedrive, <a href="https://support.pipedrive.com/en/article/visibility-groups" target="_blank" rel="noreferrer noopener">visibility groups</a> control what deals, contacts and products users can see. Creating visibility groups is useful if you want certain users to not see specific information in your company account. The number of visibility groups you have also depends on the plan you’re on. 
<ul>
<li>
Essential and Advanced plans Two visibility groups: the item’s owners and followers or the entire company</li>
<li>
Professional and higher plans Four visibility groups: item’s owner only, owner’s visibility group, owner’s visibility group and sub-groups or to the entire company</li>
</ul>
Pipeline Visibility
Users with account settings access can edit the pipeline visibility settings for users in the visibility groups by de-selecting the pipelines that each group shouldn’t be able to see. By default, all visibility groups will have access to all pipelines.
Visibility groups that don’t have access to specific pipelines won’t be able to see any trace of the pipeline nor deals inside that pipeline in Pipedrive, as the pipeline will be completely hidden from their accounts.
Users with deals admin permission set will always have access to all pipelines and deals, regardless of the visibility group settings. Learn more about pipeline visibility in <a href="https://support.pipedrive.com/en/article/pipeline-visibility" target="_blank" rel="noreferrer noopener">this article</a>. 
<hr>
<h2 style="text-align: justify">
<a name="2-fa-two-factor-authentication"></a>2FA: two-factor authentication</h2>
The <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" rel="noreferrer noopener">two-factor authentication feature </a>adds an extra layer of security to confirm that the user trying to log in to Pipedrive is actually who they say they’re. This feature can be implemented by using an authenticator app or the verification link via email. When 2FA is enabled to receive the verification link email, logging in to Pipedrive will prompt an email to be sent to the email address you use to log in to Pipedrive. This email will contain information about the login attempt and a verification link that will allow you access to your Pipedrive account. 
The authenticator app has added security, since only individuals with access to the app can retrieve the verification codes necessary to sign in, providing stronger protection against unauthorized access to your account.
<hr>
<h2 style="text-align: justify">
<a name="single-sign-on-sso"></a>Single sign-on (SSO)</h2>
Many large companies use a third-party SSO service such as Okta and Azure AD to allow users to securely authenticate and log into multiple applications with just one set of login credentials. 
Pipedrive's <a href="https://support.pipedrive.com/en/article/single-sign-on" target="_blank" rel="noreferrer noopener">single sign-on feature</a> will allow you to add Pipedrive to the SSO provider your company has set up, allowing for a stress-free Pipedrive login experience for users and a more secure way for administrators to control user access. 
<hr>
<h2 style="text-align: justify">Security dashboard<a name="security-dashboard"></a></h2>
<div style="text-align: justify" class="support-note success primary">Note: Some security dashboard features are only available on Pipedrive's Enterprise plan. The security dashboard is only visible by default to admin users. Visibility of the security dashboard for regular users can be turned on by admin users under <a href="https://support.pipedrive.com/en/article/permission-sets" target="_blank" rel="noreferrer noopener">permissions.</a> </div>
The security dashboard feature will provide full transparency of user access information and security-related activity that occurs in your company account. 
<ul>
<li>
User access and device logs Which users are accessing your account and any additional login information such as device, location and login time</li>
<li>
Audit log A log of all of the security-related changes made in your company account by any user in the past two months</li>
<li>
Security assessment A report on what Pipedrive believes are potential security vulnerabilities in your Pipedrive company account, based on current access and permission-related user settings</li>
</ul>
On Pipedrive’s Essential and Advanced plans, you won’t have access to all of these features, but you’ll have a security dashboard displaying:
<ul><li>Users logged in</li><li>A brief overview of the past week</li><li>A security assessment showing you high and low-risk issues</li></ul>
<h2 style="text-align: justify"> </h2>
<hr>
<h2 style="text-align: justify">Security rules<a name="security-rules"></a></h2>
<div class="support-note success primary">Note: The security rules feature is available for our Enterprise plan users.</div>
With the <a href="https://support.pipedrive.com/en/article/security-rules" target="_blank" rel="noreferrer noopener">security rules</a> feature, users with account settings access can enforce access restrictions to ensure that business data is only available to the right people at the right place and time.
<ul>
<li>2FA: two-factor authentication Enforce two-factor authentication for all users</li>
<li>Password rules Enforce password-related rules such as password strength, password expiration and password reuse</li>
<li>
IP address and time range access The advanced rules section of the security rules feature will allow you to limit user access by IP address and time range</li>
</ul>
<hr>
<h2 style="text-align: justify">Security alerts<a name="security-alerts"></a></h2>
<div class="support-note success primary">Note: This security alerts feature is available for our Enterprise plan users.</div>
The <a href="https://support.pipedrive.com/en/article/security-alerts" target="_blank" rel="noreferrer noopener">security alerts feature</a> will allow users with account settings access to set up email notifications according to security-related events that occur in the company account. The alerts can be configured to send out in live time or in regular daily or weekly intervals. 
<ul>
<li>
Account access alerts Email alert sent when any user access-related activity occurs, such as user logs in from a new device, user logs in from new location, etc. </li>
<li>
Data leakage and loss Email alert sent when data is exported or deleted from Pipedrive. </li>
<li>
Audit log All security alerts can be tracked in the <a href="https://support.pipedrive.com/en/article/security-dashboard" target="_blank" rel="noreferrer noopener">security dashboard</a> under the audit log. </li>
</ul>

Security features in Pipedrive

permission-and-visibility-settings

Permission and visibility settings

2-fa-two-factor-authentication

2FA: two-factor authentication

single-sign-on-sso

Single sign-on (SSO)

security-dashboard

Security dashboard

security-rules

Security rules

security-alerts

Security alerts

<div class="support-note primary">Note: Some security dashboard features are only available on Pipedrive’s Enterprise plan. By default, the security dashboard is visible only to admin users. However, admin users can turn on the visibility of the security dashboard for regular users under <a href="https://support.pipedrive.com/en/article/permission-sets" target="_blank" rel="noreferrer noopener">permissions</a>.</div>
Data security is one of the most important components of any customer-facing business. With the security dashboard feature, you’ll have full transparency of user access and security-related activity in your Pipedrive company account, as well as tips on how to improve your data’s security settings.
<figure><img class="vidyard-player-embed" src="https://play.vidyard.com/yuQ3VmWMHPbYPkTFc6Gdt2.jpg" alt=""></figure>
 To see the security dashboard of your Pipedrive company account, go to Settings &gt; Security center &gt; <a href="https://app.pipedrive.com/settings/security-dashboard" target="_blank" rel="noreferrer noopener">Dashboard</a>. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Markup%20on%202024-04-30%20at%2013%3A42%3A23.png" alt=""></figure>
The first section of your dashboard will show information related to user access in your Pipedrive company account.
You can hover over and click each of the sections to see more information.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-30%20at%2017.29.22.png" alt=""></figure>
<hr>
<h2 style="text-align: justify">
<a name="right-now"></a>Right now
</h2>
<ul>
<li>
Users logged in – A list of users logged into your Pipedrive company account at that moment and their locations. You can also see the number of offline users and the time they were logged out.
</li>
<li>
Unique locations – The number of devices logged in by location, in descending order</li>
</ul>
To find out more about the devices and users currently logged into your company account, you can click on the Active devices section in the bottom section of the dashboard. 
<hr>
<h2 style="text-align: justify">
<a name="last-7-days"></a>Last 7 days
</h2>
<div class="support-note success primary">Note: This is available on all Pipedrive plans.</div>
<ul>
<li>
New devices – The number of new devices that were used to log in in the past 7 days, which users logged in with these devices and the login time</li>
<li>
New locations – A list of new locations the devices had logged in from in the past 7 days, which users logged in under these locations and the login time</li>
<li>
Security events – The number and type of security events related to and done by your company users in the past 7 days. To see these events, click on the “Audit log” in the bottom section of the dashboard.</li>
<li>
Force logouts – The number of times the Logout or Log out all buttons had been clicked from the devices or security dashboard page, which devices were logged out as a result and the time and date they were logged out</li>
</ul>
<hr>
<h2 style="text-align: justify">
<a name="security-assessment"></a>Security Assessment
</h2>
<div class="support-note success primary">Note: This is available on all Pipedrive plans. </div>
This Security assessment section will give you a report on what Pipedrive believes are potential security vulnerabilities in your Pipedrive company account, based on current access and permission-related user settings. 
The measures are categorized as HIGH-RISK ISSUES, LOW-RISK ISSUES, or NON-ISSUES. If there are any high-risk or low-risk issues, alerts and suggestions will be provided to help decrease the amount of security risk that is detected in your company account. Click on “See what you can improve” to see the measures Pipedrive uses to assess account security. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-30%20at%2017.50.27.png" alt=""></figure>
Clicking on “Review permissions” will take you directly to the company’s permission settings, where you can adjust your user permissions accordingly.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-05-02%20at%2015.44.07.png" alt=""></figure>
Clicking on the question mark icon next to each measure will provide a tooltip from Pipedrive on how you can improve this particular security measure in your company settings. 
<div class="support-note primary">
Note: Depending on the nature and setup of your business, the security alerts and tips suggested may not be of critical urgency to your company account. We recommend looking over the measures to see which ones may be the most relevant to you before making any permission or setting changes. 
</div>
<hr>
<h2 style="text-align: justify">
<a name="active-devices"></a>Active devices
</h2>
<div class="support-note success primary">Note: The active devices feature is one of the many useful features of Pipedrive’s Enterprise plan. </div>
Under Active devices, you’ll see all the devices currently logged in to your Pipedrive company account. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Markup%20on%202024-05-02%20at%2015%3A57%3A12.png" alt=""></figure>
The following fields are provided for each device entry:
<ul>
<li>
User – The user logged in with that device and the permission level they are on</li>
<li>
Device – The device used to log in</li>
<li>
Location – The location that the device logged in from and the IP address</li>
<li>
Login – The date and time of login and the method used to log in (30d) means the user had clicked the “Remember me” button when logging in to Pipedrive and will stay logged in for 30 days. (12h) means the user had not clicked the “Remember me” button when logging in to Pipedrive and will be automatically logged out after 12 hours.
</li>
</ul>
If you hover over the device entry, you can manually log that device out by clicking the “Log out” button that appears on the right side.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-05-02%20at%2016.03.57.png" alt=""></figure>
The filter button in the top right corner will give you the option to choose which user you wish to see. If you want to force log out of all of the filtered devices or export this list to a spreadsheet, you can click on the “…” icon. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-05-02%20at%2016.06.18.png" alt=""></figure>
<hr>
<h2 style="text-align: justify">
<a name="device-history"></a>Device history
</h2>
<div class="support-note success primary">Note: The device history feature is one of the many useful features of Pipedrive's Enterprise plan.</div>
Under device history, you’ll be able to see a list of all of the devices that have been used to log in to your Pipedrive company account in the past two months. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Markup%20on%202024-05-02%20at%2015%3A39%3A17.png" alt=""></figure>
The following fields are provided for each device entry:
<ul>
<li>
User – The user logged in with that device and the permission level they are on</li>
<li>
Device – The device used to log in</li>
<li>
Location – The location that the device logged in from and the IP address</li>
<li>
Login – The date and time of login and the method used to log in</li>
<li>
Logout – The date and time of logout and the method used to log out. The method of logout can either be manually or through expiration. 
</li>
</ul>
The filter button in the top right corner allows you to choose which user and time frame you wish to see. The ”…” button also allows you to export your filtered results to a spreadsheet. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-06-04_at_3.04.34_PM.png" alt="Screen_Shot_2019-06-04_at_3.04.34_PM.png" width="300" height="187"></figure>
<hr>
<h2 style="text-align: justify">
<a name="audit-log"></a>Audit log
</h2>
<div class="support-note success primary">Note: The audit log feature is one of the many useful features of Pipedrive's Enterprise plan.</div>
Under the Audit log section, you’ll be provided with a log of all of the security-related changes made in your company account by any user in the past two months.
Configured <a href="https://support.pipedrive.com/article/security-alerts" target="_blank" rel="noreferrer noopener">security alerts</a> can be tracked under the Alerts tab. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-05-02%20at%2016.12.20.png" alt=""></figure>

The following fields are provided for each security-related event:
<ul>
<li>
User – The user name and permission level they are on</li>
<li>
Event – The security-related event that occurred</li>
<li>
Type – The type of security-related event that occurred</li>
<li>
Time – The date and time of the security-related event</li>
</ul>
In the top right corner, you can filter for the user, type of security event and time frame. The “…” button will also allow you to export your filtered results to a spreadsheet.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-11-15_at_3.55.17_PM.png" alt="Screen_Shot_2019-11-15_at_3.55.17_PM.png" width="400" height="318"></figure>
 
<hr>
<h2 style="text-align: justify">Security dashboard summary emails<a name="security-dashboard-summary-emails"></a></h2>
At the beginning of each month, all admins and users with permission to see the security dashboard receive an email summarizing security-related events from the previous month. 
This email will present the number of new devices, new locations, security events, forced logouts and high and low-risk security vulnerabilities.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-05-02%20at%2015.16.38.png" alt=""></figure>
If there’s anything worth further investigating, you can click on “Security dashboard” to be brought directly to the security page in your Pipedrive account.

right-now

Right now

last-7-days

Last 7 days

security-assessment

Security Assessment

active-devices

Active devices

device-history

Device history

audit-log

Audit log

security-dashboard-summary-emails

Security dashboard summary emails

<div class="support-note primary">
Note: The security rules feature is one of the many useful features of Pipedrive's Enterprise plan. Only users with account settings access can set up security rules in a company account. 
</div>
Keeping data safe is essential for any business. The security rules feature allows you to enforce access restrictions to ensure that business data is only available to the right people at the right place and time.
To access and set up your security rules, go to Settings &gt; Security center &gt; <a href="https://app.pipedrive.com/settings/security-rules" target="_blank" rel="noreferrer noopener">Rules</a>. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-17%20at%2017.59.49.png" alt=""></figure>
<div class="support-note success primary">Note: With the exception of two-factor authentication, security rules won’t apply when accessing Pipedrive through the mobile app. </div>
<hr>
<h2>
<a name="two-factor-authentication-2-fa"></a>Two-factor authentication (2FA)</h2>
You can toggle this option to enforce <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" rel="noreferrer noopener">two-factor authentication (2FA)</a> for all users.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-17%20at%2018.29.53.png" alt=""></figure>
Once enabled, go to Personal preferences&gt; <a href="https://app.pipedrive.com/settings/password" target="_blank" rel="noreferrer noopener">Password and login</a> &gt; Two-factor authentication (2FA), and you'll have two options to select from: the authenticator app or the verification link. The authenticator app allows you to select a specific app as the second step of authentication while with the verification email link, you'll receive a confirmation email. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-09-27%20at%2012.16.27.png" alt=""></figure>
 Each user will only need to be verified every 30 days on each device.
<hr>
<a name="C2IamCs"></a>
<h2>Password strength<a name="password-strength"></a></h2>
When a user with account settings access enforces password strength requirements, any users with passwords that don’t fulfill those requirements will be asked to change their password the next time they log in.
You can make sure user passwords have one or more of the following: 
<ul>
<li>At least one lowercase and one uppercase letter</li>
<li>At least one number</li>
<li>At least one special character ( '!', '@', '&amp;', etc.)</li>
<li>A minimum amount of characters (must be at least 8)</li>
</ul>
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-17%20at%2018.29.37.png" alt=""></figure>
<h2> </h2>
<hr>
<a name="C3IamCs"></a>
<h2>Password expiration and reuse<a name="password-expiration-and-reuse"></a></h2>
A password expiration date or password reuse condition can be set up for your users’ passwords. 
<ul>
<li>
Password expires – Your users’ passwords can be set to expire every 365 days, 180 days, 90 days, 60 days, 30 days, or never.</li>
<li>
Password reuse – Password resets can be limited to forbid just the current password or current password and one previous password</li></ul>
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-17%20at%2018.29.26.png" alt=""></figure>
<hr>
<a name="C4IamCs"></a>
<h2>Advanced rules<a name="advanced-rules"></a></h2>
When you expand the Advanced rules section, you’ll be able to set up more sophisticated security rules to limit user access.
<div class="support-note success primary">Note: Once enforced, advanced rules will immediately apply to all users without account settings access.</div>
<div class="support-note success primary"></div>
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-17%20at%2018.34.14.png" alt=""></figure>
<h3 style="text-align: justify">Allow access only for specific IP addresses<a name="allow-access-only-for-specific-ip-addresses"></a></h3>
If you want your users to only access Pipedrive when they’re in specific locations, you can add IP address conditions to your advanced security rules.
All users without account settings access will then only have access to company data when they’re under these IP addresses. Click on “Add IP address” to get started.
In the Add IP window, you can either type in an IP address or auto-fill your current IP address. Depending on your access limitation requirements, you can add more than one IP address.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Markup%20on%202024-04-17%20at%2018%3A37%3A13.png" alt=""></figure>
<h3>Allow access only at specific times<a name="allow-access-only-at-specific-times"></a></h3>
Enabling this rule will restrict user access to specific time frames, such as company working hours or a timezone.
All users without account settings access will lose access to Pipedrive outside of the added days, times and time zones.
You can click on “Add time range” to set up your time range restrictions. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-17%20at%2018.38.51.png" alt=""></figure>
 
<hr>
<a name="C5IamCs"></a>
<h2>Confirming and validating your changes<a name="confirming-and-validating-your-changes"></a></h2>
Once all of the rules are set up, you can click on “Preview and enforce” to validate your changes.
Confirm your security rule details in the window that appears and click on “Enforce now” to implement your rules. 
You can choose where to send a summary of the changes made to your users. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-04-17%20at%2018.42.26.png" alt=""></figure>

two-factor-authentication-2-fa

Two-factor authentication (2FA)

password-strength

Password strength

password-expiration-and-reuse

Password expiration and reuse

advanced-rules

allow-access-only-for-specific-ip-addresses

Allow access only for specific IP addresses

allow-access-only-at-specific-times

Allow access only at specific times

Advanced rules

confirming-and-validating-your-changes

Confirming and validating your changes

<div class="support-note success primary">Note: The security rules feature is one of the many useful features of Pipedrive's Enterprise plan. </div>
If you see any of the following access restriction prompts or errors when trying to log in to Pipedrive, your user with account settings access has set up <a href="https://support.pipedrive.com/en/article/security-rules" title="https://support.pipedrive.com/en/article/security-rules">security rules</a> to restrict user access to your company account. We recommend reaching out to a user with account settings access for more information on these restrictions.
<div class="support-note success primary">Note: With an exception of two-factor authentication, security rules won’t apply when accessing Pipedrive through the Mobile App.</div>
<hr>
<h2 style="text-align: justify">
<a name="two-factor-authentication-verification"></a>Two-factor authentication verification </h2>
When the <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" rel="noreferrer noopener">two-factor authentication</a> security rule has been applied with the verification email, all users will receive a verification notice the next time they try to log in to Pipedrive. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_11.17.26_AM.png" alt="Screen_Shot_2020-01-20_at_11.17.26_AM.png" width="600" height="462"></figure>
 If you select the authenticator app for an extra layer of security in your account, this means that only users with access to that app can view the verification codes required to log in, enhancing the protection of your account against unauthorized access.

<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-09-27%20at%2012.34.43.png" alt=""></figure>
<hr>
<h2 style="text-align: justify">
<a name="password-strength-requirements"></a>Password strength requirements</h2>
If a Password strength rule is set up, all admin and regular users will be prompted with a “Reset your password” window according to those rules the next time they try to log in to Pipedrive: 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-05-02%20at%2017.13.30.png" alt=""></figure>
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_11.45.14_AM.png" alt="Screen_Shot_2020-01-20_at_11.45.14_AM.png" width="600" height="637"></figure>
<hr>
<h2 style="text-align: justify">
<a name="password-expiration-and-reuse"></a>Password expiration and reuse </h2>
Once a user with account settings access sets up any Password expiration and reuse rule, all users will be prompted to reset their password according to those rules the next time they try to log in.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-05-02%20at%2017.13.54.png" alt=""></figure>
Depending on the condition set up under Password expires, you’ll be brought to a Reset your password window after that time frame passes. 
If the new password entered does not fulfill the requirement set up under Password reuse, you’ll see an error such as “New password cannot be the same as the current password” or “New password cannot be the same as previous password”, depending on the condition set up. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_11.58.44_AM.png" alt="Screen_Shot_2020-01-20_at_11.58.44_AM.png"></figure>
<hr>
<h2 style="text-align: justify">
<a name="advanced-rules"></a>Advanced rules </h2>
Advanced rules and restrictions will be applied to all users without account settings access when trying to access Pipedrive outside of a specific time frame or location specified. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202024-05-02%20at%2017.14.58.png" alt=""></figure>
If an IP address restriction is set up, a user who tries to log in to Pipedrive from a location not specified will see this access restricted notice when trying to log in: 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_2.05.49_PM.png" alt="Screen_Shot_2020-01-20_at_2.05.49_PM.png" width="600" height="317"></figure>
If a time range access restriction is set up, a user who tries to log in to Pipedrive from outside of the time frame will see this access restricted notice when trying to log in: 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_2.06.23_PM.png" alt="Screen_Shot_2020-01-20_at_2.06.23_PM.png" width="601" height="303"></figure>

Security rules access restrictions

two-factor-authentication-verification

Two-factor authentication verification

password-strength-requirements

Password strength requirements

<div class="support-note primary">
Note: The security alerts feature is one of the many useful features of Pipedrive's Enterprise plans. Only users with account settings access can set up security alerts in a company account. 
</div>
The security alerts feature will allow admins users to set up email notifications according to security-related events that occur in the company account. With these alerts enabled, admins will be notified immediately or regularly to assess when company data may be at risk.
To access and set up security alerts, go to Settings &gt; Security center &gt; <a href="/settings/security-alerts">Alerts</a>.
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-08-25_at_4.36.31_PM.png" alt="Screen_Shot_2020-08-25_at_4.36.31_PM.png" width="963" height="655"></figure>
<hr>
<h2 style="text-align: justify">
<a name="account-access-alerts"></a>Account access alerts</h2>
<div class="support-note success primary">Note: Security email alerts will be sent to the email address of the admin user's login email address.</div>
The Account access alerts section will allow you to receive email alerts when a user access-related event happens in your account. These alerts will be triggered by activity from both regular users and other admin users. 
You can set up email alerts for any time one of the following user access related events occurs: 
<ul>
<li>User logs in from a new device</li>
<li>User logs in from a new location </li>
<li>New user is invited</li>
<li>User has more than 3 failed login attempts in a row </li>
<li>User requests password reset </li>
</ul>
 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_2.40.44_PM.png" alt="Screen_Shot_2020-04-01_at_2.40.44_PM.png" width="599" height="275"></figure>
Once you've selected the alerts you want to receive, you can set up the grouping and time of your alerts. 
<ul>
<li>Each alert as a separate email, sent instantly</li>
<li>
All in one email, sent at a specific time – If you select this option, you will see the option to choose the day and time you wish to receive the email. </li>
</ul>
<hr>
<h2 style="text-align: justify">
<a name="data-leakage-and-loss"></a>Data leakage and loss </h2>
Alerts related to <a href="https://support.pipedrive.com/en/article/exporting-data-from-pipedrive" target="_blank" rel="noreferrer noopener">exporting</a> or deleting data are configured separately under Data leakage and loss. These alerts are triggered when another admin or regular user downloads an exported file or deletes data in Pipedrive. 
You can set up email alerts for when the following occurs:
<ul>
<li>User downloads exported deals, organizations, people, activities, or notes.</li>
<li>User deletes pipelines or stages</li>
<li>User deletes custom fields </li>
</ul>
 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_5.37.45_PM.png" alt="Screen_Shot_2020-04-01_at_5.37.45_PM.png" width="601" height="145"></figure>
 For deals, people and organization deletions, you can configure the amounts of deletions so that the email alert only gets triggered once one user deletes a certain amount of that particular item. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_3.04.01_PM.png" alt="Screen_Shot_2020-04-01_at_3.04.01_PM.png" width="602" height="123"></figure>
While each admin user can configure the alerts they individually want to receive, the amounts applied to the deal, people and organization deletion triggers will be applied company-wide and be overridden if another admin user resets the number. 
<ul>
<li>
Admin 1: Sets the deal deletion alert threshold to 20 deals deleted and saves. </li>
<li>
Admin 2: Sets the deal deletion alert threshold to 10 deals deleted and saves. </li>
<li>The number of deal deletions needed to trigger the alert set by admin 1 will now be overridden and reset to 10 for all admins who have that alert enabled.</li></ul>
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_5.45.23_PM.png" alt="Screen_Shot_2020-04-01_at_5.45.23_PM.png"></figure>
 The grouping and timing of the data leakage and loss alerts are configured separately from the account access alerts. You can choose for the alerts to send as separate emails, sent instantly, or all in one email sent at a specific time. 
<figure><img src="https://kb-cms.pipedriveassets.com/previewandenforce.png" alt="previewandenforce.png" width="600" height="176"></figure>
<hr>
<h2 style="text-align: justify">
<a name="preview-and-save-changes"></a>Preview and save changes </h2>
Once you've configured your alerts, you can click on "Preview and save" to see an overview of your alert settings before saving. These alerts will only apply to the admin setting them up. 
<h2 style="text-align: justify"></h2><figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_6.18.21_PM.png" alt="Screen_Shot_2020-04-01_at_6.18.21_PM.png" width="601" height="384"></figure>
The email alerts are configured to send out instantly:
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-02_at_3.13.08_PM.png" alt="Screen_Shot_2020-04-02_at_3.13.08_PM.png" width="499" height="510"></figure>
Email alerts configured to be sent at a specific time daily or weekly:
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-02_at_3.04.35_PM.png" alt="Screen_Shot_2020-04-02_at_3.04.35_PM.png" width="500" height="559"></figure>
<hr>
<h2 style="text-align: justify">
<a name="viewing-alerts-in-the-security-dashboard-audit-log"></a>Viewing alerts in the security dashboard audit log</h2>
All security alerts can be tracked by going to Security dashboard &gt; Audit log &gt; <a href="/settings/security-dashboard/audit-log">Alerts</a>. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-02_at_4.19.49_PM.png" alt="Screen_Shot_2020-04-02_at_4.19.49_PM.png" width="601" height="383"></figure>
 
For the deleted deal, people and organization alerts and failed login attempts, you can click on the event to see a full list of the items deleted.
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-02_at_5.49.50_PM.png" alt="Screen_Shot_2020-04-02_at_5.49.50_PM.png" width="700" height="235"></figure>

account-access-alerts

Account access alerts

data-leakage-and-loss

Data leakage and loss

preview-and-save-changes

Preview and save changes

viewing-alerts-in-the-security-dashboard-audit-log

Viewing alerts in the security dashboard audit log

<div class="support-note success primary">Note: The security dashboard feature is one of the many useful features of Pipedrive's Enterprise plan.</div>
Pipedrive offers many easy-to-use security-related features to give you full transparency of when and how your data is being accessed. 
If you already have the <a href="https://support.pipedrive.com/en/article/single-sign-on" target="_blank" rel="noreferrer noopener">single sign-on</a> feature enforced in your company account, you will not see the <a href="https://support.pipedrive.com/en/article/security-rules#C1IamCs" target="_blank" rel="noreferrer noopener">two-factor authentication</a>, <a href="https://support.pipedrive.com/en/article/security-rules#C2IamCs" target="_blank" rel="noreferrer noopener">Password strength</a> and <a href="https://support.pipedrive.com/en/article/security-rules#C3IamCs" target="_blank" rel="noreferrer noopener">Password expiration and reuse</a> options under the <a href="https://support.pipedrive.com/en/article/security-rules" target="_blank" rel="noreferrer noopener">security rules</a> feature. They are hidden under security rules because SSO is a more secure way of protecting data and, therefore, overrides these options. 
The Advanced rules section will always be available under security rules regardless of whether SSO is enforced or not. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_2.53.26_PM.png" alt="Screen_Shot_2020-01-20_at_2.53.26_PM.png" width="601" height="394"></figure>
If single sign-on is enabled in your account but not enforced, the 2FA, Password strength and Password expiration and reuse sections will be available to be set up by a user with account settings access under security rules.

Using SSO (single sign-on) with security rules

<div class="support-note primary">
Note: The single sign-on feature is one of the many useful features available for all Pipedrive plans.</div>
If you have a big Sales team, you know the administrative pain of creating multiple new accounts every time someone joins your team. To help you cut back onboarding time and overheads, we have single sign-on – or SSO.
<figure><img class="vidyard-player-embed" src="https://play.vidyard.com/sKGzqHumSa3bGztFQZLS1K.jpg" alt=""></figure>
<div class="support-note primary">
Note: If you’re just getting started with Pipedrive, check out our ”Get your team on board“ <a href="https://learn.pipedrive.com/app/courses/8847bfbd-fb2b-440d-a7bb-24467515720f" target="_blank" rel="noreferrer noopener">Pipedrive Academy course</a>.</div>
<hr>
<h2 style="text-align: justify"><a name="setting-up-sso"></a>
Setting up SSO </h2>
<div class="support-note success primary">Note: Setting up SSO requires some technical expertise, so we suggest speaking to your internal IT teams for their assistance in providing the necessary information for SAML configuration.</div>
An account with SSO enabled only requires one set of logins for all of your users. You can set up an account for them in your system and they'll automatically have login credentials for Pipedrive, saving your team time and effort.
 
To configure SAML settings for single sign-on, account settings admin users can go to Company settings &gt; <a href="https://app.pipedrive.com/settings/sso" target="_blank" rel="noreferrer noopener">Single sign-on</a> in their company Pipedrive account. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/sso%201.jpg" alt=""></figure>
You'll need to enter several keys and certificates that your internal IT team should be able to provide. Once you‘ve tested the provided information and confirmed that it works, click “Enable for users.” 
The information will need to be copied over to your SSO provider. We have more information on how to set up SSO for the most popular SSO providers here: 
<ul><li><a href="https://support.pipedrive.com/en/article/pipedrive-single-sign-on-entra-id" target="_blank" rel="noreferrer noopener">SSO with Entra ID (formerly Azure AD)</a></li><li><a href="https://support.pipedrive.com/en/article/pipedrive-single-sign-on-okta" target="_blank" rel="noreferrer noopener">SSO with Okta</a></li></ul>
<div class="support-note success primary">Note: To disable password access to Pipedrive and rely on SSO alone, click “Enforce SSO login.”</div>
<hr>
<h2 style="text-align: justify"><a name="user-access"></a>User access</h2>
Granting users access 
A user must be given access to Pipedrive in your SSO provider (e.g., Okta) settings before they can log in to Pipedrive using SSO. 
If the user is already active in Pipedrive using the same email, a user verification flow will activate. 
Logging in and logging out
Go to your account's <a href="http://app.pipedrive.com/auth/sso" target="_blank" rel="noreferrer noopener">settings</a> to set up log in with single sign-on.
<div style="text-align: justify" class="support-note success primary">Note: Clicking ”Log out from Pipedrive“ logs you out of Pipedrive, not your SSO provider.</div>
<hr>
<h2 style="text-align: justify"><a name="deactivating-a-user"></a>Deactivating a user </h2>
When deactivating a Pipedrive user through your SSO system, keep the following things in mind:
<ul>
<li>Deactivating a user disables their login credentials. If you don't intend to replace that user, make sure to remove the seat as well to avoid any unexpected charges on your invoice.</li>
<li>While the user's login credentials will be disabled, they can still access their account for up to thirty days if they remain logged in. To prevent any issues, we suggest asking users to log out of Pipedrive before <a href="https://support.pipedrive.com/en/article/how-can-i-deactivate-or-reactivate-a-user#C1IamCs" target="_blank" rel="noreferrer noopener">deactivating</a> them in both Pipedrive and your SSO provider.</li></ul>
<div class="support-note success primary">Note: The single sign-on feature does not work alongside Pipedrive's <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" rel="noreferrer noopener">two-factor authentication</a> function.</div>

setting-up-sso

Setting up SSO

user-access

User access

deactivating-a-user

Deactivating a user

<div class="support-note success primary">Note: Due to differing protocols, Pipedrive’s two-factor authentication can’t work alongside the “Log in with Google” function or the <a href="https://support.pipedrive.com/en/article/single-sign-on" target="_blank" rel="noreferrer noopener">single-sign-on feature</a> of the Advanced, Professional, Power and Enterprise plans. We suggest your company choose the option that best fits its security needs.</div>
Your Pipedrive account contains valuable business information, customer data and possibly access to other integrated tools. It’s your business's lifeline, so you should always protect it.
A strong password can help to keep your account and data safe, but it’s vulnerable to data breaches, guessing, and phishing.
Two-factor authentication, or 2FA, adds another layer of security to your personal information and we strongly suggest enabling it for your Pipedrive user account 
<hr>
<h2 style="text-align: justify">Where to find it<a name="where-to-find-it"></a></h2>
To access two-factor authentication, go to Personal preferences &gt; <a href="https://app.pipedrive.com/settings/password" target="_blank" rel="noreferrer noopener">Password and login</a> &gt; Two-factor authentication (2FA) and enable either the authenticator app or verification link options for your user account in Pipedrive. <figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/2fa-1.png" alt=""></figure>

<div class="support-note success primary">Note: The two-factor authentication verification link can be opened through the mobile app, however, it must be set up in the web app. Once two-factor authentication is set up on the account, a verification email will be sent when you log in via the mobile app, just as it does when logging in through the web app.</div>
<hr>
<h2>Authenticator app<a name="authenticator-app"></a></h2>
Implementing two-factor authentication (2FA) with an authenticator app significantly enhances account security by requiring a second form of verification beyond the traditional username and password. This reduces the risk of unauthorized access, as attackers would need both the password and the physical device to generate the authentication code. Benefits of 2FA with an Authenticator App
<ul><li>Enhanced Security: Authenticator apps generate time-sensitive codes, making it difficult for attackers to gain access even if they have the user’s password</li><li>Protection Against Phishing: Since the code is generated on a separate device, phishing attempts to steal passwords are less effective</li><li>Reduced Account Compromise: Data breaches involving password theft are mitigated as the second factor is required for access</li><li>User Control: Users have more control over their account security with an additional layer of protection</li></ul>
To enable this option, click on “Connect authenticator app”.<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/2fa-2.png" alt=""></figure>

Once you click on it, for security purposes, you may be asked to re-enter your password.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/re-enter%20pass.png" alt=""></figure>
Then, you’ll need to connect your Pipedrive account to the authenticator app of your preference. There are two ways to do it:
<ul><li>Scan the QR code with your authenticator app</li><li>Enter a 6-digit code from your authenticator app</li></ul><figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/2fa-4.png" alt=""></figure>

After successfully connecting your authenticator app, you’ll see a screen with backup codes. <figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/2fa-5.png" alt=""></figure>

These codes can be used to access your account if you lose access to your authenticator app.
<div class="support-note warning">Note: We recommend saving these codes in a secure location by either downloading them as a TXT file or copying them to your clipboard. They should be stored in a password manager, printed on a piece of paper or similar. Misplaced or exposed codes can compromise account security.</div>
Once the 2FA with the authenticator app is successfully set up, you’ll receive an email confirming the changes.<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/2fa-6.png" alt=""></figure>

<div class="support-note warning">Note: If you didn’t set up the authenticator app and suspect your account might be compromised, <a href="https://support.pipedrive.com/contact-us" target="_blank" rel="noreferrer noopener">contact our support team immediately</a>.</div>
<hr>
<h2 style="text-align: justify">Verification link <a name="verification-link"></a></h2>
We always recommend using the authenticator app as the second layer of protection for your account. If, for any reason, you can’t use one, there’s a simpler but less secure 2FA option available as well: a verification link via email.
Be mindful that since your password can also be reset via the same email, an attacker only has to compromise your email inbox to take over your account. 
When enabled, logging in to Pipedrive will prompt an email to be sent to the email address you use to log in to Pipedrive with a verification link that will allow you access to your Pipedrive account.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Markup%20on%202024-06-27%20at%2008%3A38%3A15.png" alt=""></figure>
You need to open the verification link from a native email app, such as Gmail, Microsoft Outlook, ProtonMail, etc. That same email will provide you with information about where that verifiable login occurred in the world.
<div style="text-align: justify" class="support-note warning">Note: If you find that the information presented on that email does not match your login attempt, we suggest <a href="https://support.pipedrive.com/en/article/how-can-i-change-or-reset-my-password" target="_blank" rel="noreferrer noopener">changing your login credentials</a>, as someone may be attempting to gain access to your account. </div>

where-to-find-it

Where to find it

authenticator-app

Authenticator app

verification-link

Verification link

The added layer of security provided by <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" rel="noreferrer noopener">two-factor authentication</a> (2FA) also restricts the ability to effectively sync with some providers when using the email sync feature. If you wish to sync your Outlook account to Pipedrive while still enabling two-factor authentication (2FA), Outlook recommends that you follow <a href="https://docs.microsoft.com/en-us/azure/active-directory/user-help/multi-factor-authentication-end-user-app-passwords" target="_blank" rel="noreferrer noopener">these steps</a>.

How can I sync Outlook when I have 2FA enabled?

<div class="support-note success primary">Note: This can only be set up by an admin user in both Microsoft Entra ID and Pipedrive.</div>
Pipedrive’s <a href="https://support.pipedrive.com/en/article/single-sign-on">single sign-on (SSO)</a> feature integrates with <a href="https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id" target="_blank" rel="noreferrer noopener">Microsoft Entra ID</a> (formerly Azure AD) to ensure that your team can access Pipedrive easily using your identity provider.
<hr>
<a name="C1"></a>
<h2 style="text-align: justify">Installing Pipedrive in Entra ID<a name="installing-pipedrive-in-entra-id"></a></h2>
<div class="support-note success primary">Note: For an in-depth guide to integrating Entra ID and Pipedrive, check out this <a href="https://learn.microsoft.com/en-us/entra/identity/saas-apps/pipedrive-tutorial" target="_blank" rel="noreferrer noopener">support page. </a></div>
Start by going to your Entra ID account in Microsoft and selecting Identity &gt; Enterprise applications &gt; + New application.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/entra%201.jpg" alt=""></figure>
From there, use the search bar to find Pipedrive and choose that option. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/entra%202.jpg" alt=""></figure>
Then click ”Create“ to add it to your enterprise applications. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/entra%203.jpg" alt=""></figure>
<div class="support-note success primary">Note: You can also rename your app connection during this step under Name. </div>
<hr>
<h2 style="text-align: justify">Setting up SSO <a name="setting-up-sso"></a></h2>
<div class="support-note success primary">Note: You can also find your SSO options by going to your enterprise applications and selecting Pipedrive. </div>
After you add Pipedrive as an app, you’ll be redirected to a window with the details about your new connection. 
From here, click ”Single sign-on" and then select ”SAML“ from the available options. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/entra%205.jpg" alt=""></figure>
From there you can edit your configuration as needed. Any required fields will be marked in red, and you can use the <a href="https://learn.microsoft.com/en-gb/entra/identity/saas-apps/pipedrive-tutorial" target="_blank" rel="noreferrer noopener">configuration guide</a> to help with setting it up.
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/entra%204.jpg" alt=""></figure>
After you’ve configured your SAML, click ”Test“ at the bottom of the screen to confirm your connection. 
<figure style="margin-left:auto;margin-right:auto;text-align:center;"><img src="https://kb-cms.pipedriveassets.com/Entra%206.jpg" alt=""></figure>
If the connection works, you’ll be redirected to your Pipedrive account login screen where you can connect the account.

Using Pipedrive single sign-on with Microsoft Entra ID

installing-pipedrive-in-entra-id

Installing Pipedrive in Entra ID

<div class="support-note success primary">Note: This integration can only be configured by the admin user in both Okta and your Pipedrive account.</div>
Pipedrive's <a href="https://support.pipedrive.com/en/article/single-sign-on">single sign-on (SSO)</a> feature integrates with Okta to ensure that your team can access Pipedrive easily using your identity provider.
<hr>

<h2><a name="install-the-app"></a>Install the app</h2>
To begin, install the Pipedrive app from your Okta administrator dashboard. An admin user can select Applications, search for Pipedrive and click "Add". 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen%20Capture%20on%202021-03-24%20at%2009-51-37.gif" alt="Okta start"></figure>
Enter the subdomain of your Pipedrive account into the corresponding field before clicking "Next" to confirm. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screenshot%202021-03-24%20at%2010.00.10.png" alt="Okta Subdomain"></figure>
 
<hr>
<h2><a name="configuring-sso"></a>Configuring SSO</h2>
Make sure to assign your users to Pipedrive from Okta before testing the single sign-on. Under "Applications", click the gear symbol, and "Assign to Users".
<figure><img src="https://kb-cms.pipedriveassets.com/Assign%20to%20users.png" alt="Assign to users"></figure>
To start configuring single sign-on, select "SAML 2.0" under Sign-on methods and click "View setup instructions".
<figure><img src="https://kb-cms.pipedriveassets.com/Screenshot%202021-03-24%20at%2010.06.17.png" alt="SAML 2.0"></figure>
On the <a href="https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Pipedrive.html?base%5B%E2%80%A6%5Dadmin.okta.com&amp;app=pipedrive&amp;instanceId=0oacvzounNX8DAL7b5d6">Setup Instructions </a><a href="https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Pipedrive.html?base%5B%E2%80%A6%5Dadmin.okta.com&amp;app=pipedrive&amp;instanceId=0oacvzounNX8DAL7b5d6">page</a>, you will find values for Issuer, Single sign-on (SSO) URL and X.509 certificate that you need to enter in your Pipedrive <a href="http://app.pipedrive.com/settings/sso">SSO settings page.</a> Your Pipedrive SSO settings page can be found by going to Settings &gt; security center &gt; <a href="https://app.pipedrive.com/settings/sso">Single sign-on</a>.
You can copy and paste all of these fields directly to their corresponding fields in Pipedrive. 
<figure style="max-width:570px;"><img src="https://kb-cms.pipedriveassets.com/Markup%202021-03-24%20at%2010.42.34.png" alt="Okta SSO blur" width="570" height="632"></figure>
<figure style="max-width:571px;"><img src="https://kb-cms.pipedriveassets.com/Markup%202021-03-24%20at%2010.39.24%20%281%29.png" alt="SSo PD" width="571" height="485"></figure>
<hr>
<h2><a name="testing-the-sso-setup"></a>Testing the SSO setup</h2>
Once you have copied and pasted the values, click "Save and test". If everything has been configured correctly, you should see a success message.
<figure style="max-width:596px;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202021-03-24%20at%2010.52.45.png" alt="SSO success" width="596" height="65"></figure>
You can then enable SSO for your users by clicking the toggle at the bottom of the page.
<figure><img src="https://kb-cms.pipedriveassets.com/Enable%20for%20users.png" alt="Enable for users"></figure>

Knowledge Base

Security features

Got any questions?