# Single sign-on

> SAML and OIDC sign-in through your own identity provider.

SSO lets members sign in through your identity provider instead of holding a
Blueprintr password. Blueprintr supports Okta, Entra ID, Google Workspace and
any SAML 2.0 or OIDC provider.

Configuring it needs `sso.manage`.

![blueprint:josh/sso-vs-scim](https://blueprintr.io/embed/josh/sso-vs-scim#h=500)

> [!IMPORTANT]
> SSO is provisioned per organisation rather than self-served. Until it has
> been provisioned for yours, the SSO settings page reports that it is not yet
> available. Ask your account contact to enable it.

## What you will exchange

Setting up a connection is an exchange of metadata:

> [!STEPS]
>
> === Create the application in your IdP
>
> SAML 2.0 or OIDC, whichever you standardise on.
>
> === Give your IdP Blueprintr's endpoints
>
> The ACS URL and entity id, or the OIDC redirect URI, are shown on the SSO
> settings page.
>
> === Give Blueprintr your IdP's metadata
>
> The metadata URL or XML, or the OIDC issuer, client id and secret.
>
> === Test with one account
>
> Before you enforce it. Enforcing a misconfigured connection locks everyone
> out.

## Sign-in behaviour

Once connected, members sign in through your IdP. Whether that becomes the
*only* way in is a separate decision. Enforce it once you have confirmed a
working login and an owner who can still get in if the IdP is unavailable.

## Provisioning

SSO decides who may sign in.
[SCIM](/foliums/blueprintr-user-guide/enterprise/scim-provisioning) decides who
is a member and removes access when someone leaves your directory.