> For the complete documentation index, see [llms.txt](https://docs.currents.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.currents.dev/dashboard/administration/sso-saml2.0/setting-up-sso.md).

# Setting Up SSO

Request SSO from the dashboard - a four-step wizard that collects the identity provider details Currents needs to connect it

SSO setup starts in the dashboard rather than in a support conversation. A four-step wizard on **Manage Team → Domain access & SSO → Set up SSO** collects everything Currents needs - the identity provider, its metadata, the email domains it covers and the role new users land with - and submits it as one request.

{% hint style="info" %}
SSO is part of the Business and Enterprise plans.
{% endhint %}

The wizard gathers details; it does not switch SSO on by itself. See [what happens after the request](#after-the-request).

## Step 1 — Identity provider

<figure><img src="https://3745692499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqmFDEiUa9mr11LUlxDnt%2Fuploads%2Fgit-blob-ab658b6a2336ba607715e70759ac620fbe2e8351%2Fsso-setup-provider.png?alt=media" alt="Step 1 of the SSO wizard, listing Okta, Microsoft Entra ID, JumpCloud and Another SAML 2.0 provider"><figcaption><p>The provider chosen here decides which guide the next step links to</p></figcaption></figure>

Four choices: **Okta**, **Microsoft Entra ID (Azure AD)**, **JumpCloud**, and **Another SAML 2.0 provider**. The pick is not only a label - it decides which instructions and which setup guide the next step shows.

## Step 2 — Add Currents to the identity provider

<figure><img src="https://3745692499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqmFDEiUa9mr11LUlxDnt%2Fuploads%2Fgit-blob-3c1f83c45b80f25a9821276ca4cf797fcc31930b%2Fsso-setup-idp-values.png?alt=media" alt="Step 2 of the SSO wizard, showing the Okta catalog instructions and the ACS URL, Entity ID, Name ID format and attribute values"><figcaption><p>The values a manually created SAML app needs, each with a copy control</p></figcaption></figure>

For a provider with a Currents app in its catalog - Okta is the case called out - the step names the catalog path and links to the full guide. The catalog app arrives with these values already set.

Where there is no catalog app, the step lists the values a SAML application needs, each with a copy control next to it: the **ACS URL (Reply URL)**, the **Entity ID (Audience URI)**, the **Name ID format**, and the **email** and **name** attribute names. They match [SAML2.0 Configuration](/dashboard/administration/sso-saml2.0/saml2.0-configuration.md), which also covers the requirements the wizard summarizes in one line - chiefly that the Name ID must be the user's email address in lowercase, and that the `identifier` claim must carry that same value.

## Step 3 — Details

<figure><img src="https://3745692499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqmFDEiUa9mr11LUlxDnt%2Fuploads%2Fgit-blob-fd87daec0bdc8dd0bcf4386057cd0b349d593aa8%2Fsso-setup-details.png?alt=media" alt="Step 3 of the SSO wizard, with the metadata URL field, email domains field, role selection and SCIM checkbox"><figcaption><p>Everything Currents needs to connect the identity provider</p></figcaption></figure>

| Field                  | What it takes                                                                                                                                                                                                                                                       |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **IdP metadata**       | Either a metadata URL or an uploaded metadata file. The step names where to find it in the chosen provider.                                                                                                                                                         |
| **Email domains**      | The domains whose users sign in through the identity provider, separated by commas.                                                                                                                                                                                 |
| **Role for new users** | **Member** or **Guest**. New users receive this role while seats are free; after that they join as guests until an administrator upgrades them.                                                                                                                     |
| **SCIM provisioning**  | An optional checkbox. Selecting it includes [SCIM User Provisioning](/dashboard/administration/sso-saml2.0/scim-user-provisioning.md) in the same request. Once SSO is on, the **SCIMv2 Endpoint** and **Authorization Bearer Token** appear under **Manage Team**. |

The domains listed here are what SSO applies to, and they are separate from the domains under [Verified Domains](/dashboard/administration/email-domain-based-access.md) - that list decides which organization a new account joins, this one decides how people sign in.

## Step 4 — Review

<figure><img src="https://3745692499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqmFDEiUa9mr11LUlxDnt%2Fuploads%2Fgit-blob-5bec99217c4f3c1d4c3187fb8e4bf5928f74ef0b%2Fsso-setup-review.png?alt=media" alt="Step 4 of the SSO wizard, summarising the provider, metadata, domains, role and SCIM choice above a Send request button"><figcaption><p>Everything the request carries, before it is sent</p></figcaption></figure>

The last step restates every answer and sends the request with **Send request**. Up to **5 requests per hour** can be sent, so a correction after a mistyped metadata URL costs nothing.

## After the request

Currents support connects the identity provider and sends back a link to test sign-in. **SSO applies to the rest of the organization only after that test succeeds** - nobody is locked out while the configuration is being checked.

Once it is on, everyone with an email on the listed domains signs in through the identity provider and can no longer use a password or a social sign-in for Currents. Users are created the first time they sign in, unless SCIM is provisioning them.

If sign-in fails at that point, see [Troubleshooting SSO](/dashboard/administration/sso-saml2.0/troubleshooting-sso.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.currents.dev/dashboard/administration/sso-saml2.0/setting-up-sso.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.