> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure SSO
> Set up Single Sign-On with Profound over SAML or OIDC
Set up Single Sign-On (SSO) with Profound over Security Assertion Markup Language (SAML) or OpenID Connect (OIDC). Profound supports various identity providers (IdPs), including Microsoft Azure AD, Google Workspace, Okta, and any custom SAML-compliant or OIDC-compliant IdP.
**QUICK FACTS**
* SSO setup is **self-serve**. Anyone can complete it and pass the values to their IT team.
* You set up SSO in the configuration portal, which **takes you outside Profound**.
* **Exit the setup and come back anytime**. The values you entered or generated stay in place, and your team keeps signing in as usual until you enable SSO in the last step of the setup guide.
* **Profound doesn't publish fixed SSO connection values** such as the ACS URL, Entity ID, or Redirect URI, and you don't need to request them. The portal generates them for your organization as you follow the [setup steps](#setup-steps).
## Before you start
You'll need:
* The [Admin role](/platform-config/people/roles-and-permissions) in your Profound organization
* Administrative access to your IdP
* The domain you want to enable for SSO
* An account in your IdP on the SSO domain, for running the test sign-in
* Access to your DNS records to verify domain ownership
## Setup steps
1. In Profound, select your organization name at the top left of the screen, then select **Settings**.
2. Select **Enterprise Setup** under **Organization** in the left navigation sidebar. The **Single Sign-On** card shows your current SSO status and verified domains.
3. Select **Configure SSO** to open the configuration portal.
The portal takes you to the domain verification step. Follow it as described in [Domain verification guide](/platform-config/authentication/sso-domain-verification). The remaining steps become available after the domain is verified.
This step is for adding a DNS record, not for connecting your IdP. You select your IdP, such as Okta or Microsoft Entra ID, in the next step.
Profound checks the email domain of each user who signs in through your IdP against your verified domains, and rejects the sign-in when it doesn't match or when your organization has no verified domains.
After your domain is verified, the **Single Sign-On** card shows the status **In progress** until you enable SSO.
Select your IdP from the list of supported options. After you select it, the portal shows setup instructions specific to your provider.
If your provider isn't on the list, use the custom SAML or OIDC connection option. If you run your own authorization server rather than a commercial IdP, use the custom OIDC connection option.
The portal walks you through connecting your IdP to Profound. It shows the values to copy from Profound into your IdP, and the values to retrieve from your IdP and enter into the portal. Copy the Profound values from the portal. They're generated per SSO connection and don't appear anywhere else in Profound.
The values you exchange depend on your SSO protocol:
* Profound → IdP: the Authorized Redirect URI
* IdP → Profound: the Discovery Endpoint, Client ID, and Client Secret
* Profound → IdP: the ACS URL, Service Provider Entity ID, and Metadata URL
* IdP → Profound: the SSO URL, Entity ID, and X.509 Certificate
Follow the instructions shown in the portal for your specific IdP and protocol.
The final step in the portal validates your connection. Select **Test sign-in** to run a real sign-in through your IdP. The portal redirects you to your IdP, you sign in with an account on the domain you verified, and your IdP returns you to the portal with the result:
* **Test successful**: your IdP returned a valid response and the connection is configured correctly.
* **Test failed**: the portal shows the validation error and debugging steps. Repeat [Step 4](#step-4) to correct the connection values, then run the test again.
Run the test as many times as you need. The portal records each attempt in the **Sessions** list on its SSO screen. Select a session to see the request sent to your IdP and the response it returned. These details help when you troubleshoot with your IdP administrator or Profound's [customer support](mailto:support@tryprofound.com).
**Notes**:
* Testing happens in your own Profound organization, a separate test organization isn't needed.
* Running a test sign-in only affects the account you test with.
* Your team keeps signing in as usual until you enable SSO in the next step.
To start over with a different IdP or protocol, select **Reset Connection** in the portal and follow the prompts.
After the test passes, enable SSO for your domain directly from the portal. Back on the **Enterprise Setup** page, the status reads **SSO Enabled** and your domain is marked **Verified**. Select **Check status** to refresh.
After you enable SSO, Profound automatically directs users whose email addresses match your configured domains to your IdP for authentication.
## Notes
* Each Profound organization needs its own SSO connection.
* Subdomains can't use the same SSO connection as the root domain: each subdomain needs its own connection.
* Keep each domain's verification TXT record in place for as long as SSO is enabled for that domain.
* For SAML connections, renew your IdP signing certificate before it expires. The **Single Sign-On** card shows a warning as the expiry date approaches.
* Contact [customer support](mailto:support@tryprofound.com) if you need help during setup.