> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO configuration

> Let workspace users sign in with your identity provider using SAML single sign-on or social login, and provision governance reviewers automatically.

Choose how your workspace users sign in. Enabling single sign-on (SSO) delegates authentication to a trusted identity provider (IdP), removing the need for separate Oleria passwords and giving your team a consistent login experience.

From **Settings → SSO Configuration**, you can connect one or more SAML identity providers and enable Microsoft social sign-in. Google social sign-in is available by default. For the governance app, you can provision reviewers automatically the first time they sign in.

Only Administrators can change SSO settings.

## Main workspace and governance app

The **SSO Configuration** page has two tabs, each configuring sign-in for a different part of Oleria independently:

* **Main Workspace** - how everyone with a workspace role signs in to your Oleria workspace.
* **Governance App** - how reviewers sign in to the governance app to complete [access reviews](/governance/access-review), request and approve access requests, and review workflows.

Each tab has its own list of SAML identity providers and its own social sign-in settings, so you can connect different providers to each. Automatic user provisioning is available on the **Governance App** tab only.

<Note>
  Both tabs show the same **Oleria details** (Entity ID, ACS URL, and Single logout URL) while you add an identity provider, because they share a single service provider. This is expected - copy the same details into whichever identity provider you connect to either tab.
</Note>

## Connect a SAML identity provider

Adding a SAML identity provider is a two-step exchange: you tell Oleria how to reach your IdP, then you copy Oleria's service provider details back into that IdP.

<Steps>
  <Step title="Open the SSO configuration page">
    Go to **Settings → SSO Configuration** and select the **Main Workspace** or **Governance App** tab, depending on who should sign in through this provider.
  </Step>

  <Step title="Start adding an identity provider">
    In the **SAML IdP** card, click **Add IdP**.
  </Step>

  <Step title="Enter the SAML IdP details">
    Complete the **SAML IdP details** step:

    * **Name** - a label for the provider. Use 3-32 characters. The name must be unique across your entire workspace, including both tabs, cannot contain spaces, and cannot be `google`, `microsoft`, or `cognito`. **You cannot change the name after you create the provider.**
    * **Sign requests** - select to sign the SAML authentication requests Oleria sends to your identity provider.
    * **Encrypt SAML responses** - select to require your identity provider to encrypt its SAML responses.
    * **Metadata** - provide your IdP's SAML metadata in exactly one of two ways: enter a metadata **URL** (must start with `https://`), or paste the metadata **XML document**. Provide one or the other, not both.
  </Step>

  <Step title="Copy the Oleria details into your identity provider">
    On the **Oleria details** step, copy the **Entity ID**, **ACS URL**, and **Single logout URL** into your identity provider's SAML application configuration. These values identify Oleria as the service provider and tell your IdP where to send responses. If you selected **Sign requests**, also give your identity provider the **Request signing certificate** shown on this step, so it can verify the requests Oleria sends.
  </Step>

  <Step title="Save the identity provider">
    Click **Add identity provider**. Users can now sign in through this provider.
  </Step>

  <Step title="Confirm sign-in works">
    Sign out of Oleria, select the provider on the sign-in page, and confirm you land back in Oleria.
  </Step>
</Steps>

<Note>
  If Oleria cannot reach or parse the metadata at the URL you entered, the save fails. Confirm the URL is correct, publicly reachable, and served over HTTPS, then try again.
</Note>

## Edit or remove an identity provider

In the identity providers list, use the actions next to a provider:

* **Edit** (pencil) - update the provider's settings. Every field except **Name** can be changed.
* **Remove** (trash) - delete the provider. Removal takes effect immediately. Users can no longer sign in through it, so make sure another sign-in method is available first.

## Enable Microsoft social sign-in

You can let users sign in with a Microsoft account instead of, or in addition to, a SAML provider.

<Steps>
  <Step title="Open the tab you want to configure">
    Go to **Settings → SSO Configuration** and select the **Main Workspace** or **Governance App** tab.
  </Step>

  <Step title="Select Microsoft account">
    Select **Enable Microsoft account**.
  </Step>

  <Step title="Save your changes">
    Save the settings. Microsoft is now available on the sign-in page.
  </Step>
</Steps>

## Automatically provision reviewers

On the **Governance App** tab, automatic user provisioning creates an Oleria account for people the first time they sign in through a SAML provider or a social connection. You do not have to add each reviewer by hand. Automatically provisioned users are added as [reviewers](/governance/scim-reviewer-provisioning).

<Note>
  Automatic user provisioning is available for the governance app only. It is not available on the **Main Workspace** tab.
</Note>

You control who can be provisioned with two lists:

* **Allowed domains** - up to 10 email domains (for example, `acme.com`). A domain must match exactly; `acme.com` does not include subdomains such as `eu.acme.com`. Only people whose email domain is on this list can be provisioned.
* **Blocked emails** - up to 50 individual email addresses (for example, `name@acme.com`). People on this list are never provisioned, even if their domain is allowed.

<Steps>
  <Step title="Open the Governance App tab">
    Go to **Settings → SSO Configuration** and select the **Governance App** tab.
  </Step>

  <Step title="Enable automatic user provisioning">
    Select **Enable automatic user provisioning**.
  </Step>

  <Step title="Add at least one allowed domain">
    Under **Allowed domains**, add the email domains that should be provisioned automatically. Optionally, add addresses to **Blocked emails** to exclude specific people.
  </Step>

  <Step title="Save your preferences">
    Click **Save preferences**. The new settings apply to the next sign-in. They do not change accounts that already exist.
  </Step>
</Steps>

<Warning>
  You must add at least one allowed domain before you can save with automatic user provisioning enabled. Saving with the toggle on and no allowed domains fails.
</Warning>

<Note>
  When automatic user provisioning is off, someone who signs in through SSO but does not already have an Oleria account is denied access. Either select **Enable automatic user provisioning** or add the person in [Manage Users](/administration/manage-users) first.
</Note>

## Contact us

For questions, contact us at [support@oleria.com](mailto:support@oleria.com).