Single sign-on is now available on the Enterprise plan. The Security Overview says how it works and what it does not cover yet.
Added · Security Overview, Signing in and sessions
On the Enterprise plan, a workspace can sign its people in through its own identity provider over SAML or OpenID Connect, after proving its email domains with a DNS record. It can require single sign-on, so that a session from anywhere else reads nothing; the workspace owner keeps a password in case the identity provider is down.
Changed · Security Overview, What we do not have yet
Before: Single sign-on (SAML or OIDC) is planned for enterprise plans and not built yet.
Now: Single sign-on does not yet include SCIM provisioning or mapping identity provider groups to roles, and the iPhone app does not offer it yet.