> ## Documentation Index
> Fetch the complete documentation index at: https://ai-kb.automationanywhere.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On (SSO)

> Overview of enterprise SSO options for EKB — Okta, Azure AD, custom SAML, and team-owned IdPs

Use **SSO** so people sign in to EKB with your organization’s identity provider instead of (or in addition to) email/password and Google sign-in.

EKB’s support team typically configures and tests platform SSO after you set up the application in your IdP and send metadata. For an IdP owned by a **specific team or sub-team** (not platform-wide), see [Team SSO](/my-account/team-sso).

## Choose a guide

<CardGroup cols={2}>
  <Card title="Okta" icon="key" href="/general/authentication/okta-sso">
    Okta is your enterprise IdP
  </Card>

  <Card title="Azure AD" icon="microsoft" href="/general/authentication/azure-ad-sso">
    Microsoft Entra ID / Azure AD
  </Card>

  <Card title="Custom SAML" icon="id-card" href="/general/authentication/custom-sso">
    Any other SAML 2.0–compatible IdP (Ping, OneLogin, Auth0, etc.)
  </Card>

  <Card title="Team SSO" icon="users" href="/my-account/team-sso">
    Each team or sub-team brings its own IdP
  </Card>
</CardGroup>

Related sign-in methods (not SAML SSO):

<CardGroup cols={2}>
  <Card title="Email & password" icon="envelope" href="/general/authentication/email-password">
    Sign in with email and password
  </Card>

  <Card title="Google sign-in" icon="google" href="/general/authentication/google-sign-in">
    Sign in with a Google account
  </Card>
</CardGroup>

## How platform SSO works

1. An admin creates a SAML application in your IdP (ACS URL, Entity ID, Name ID, attributes).
2. You collect the IdP **metadata URL** (or metadata XML) and your **enterprise email domain**.
3. You send those details to [Support](mailto:support@automationanywhere.com) (provider name, domain, metadata, and whether **SSO Sign-In Only** should apply).
4. EKB configures and tests the connection on your instance, then enables SSO for that domain.

Exact ACS URLs and claim mappings differ by provider — use the Okta, Azure AD, or Custom guide above.

## SSO Sign-In Only

When **SSO Sign-In Only** is enabled for a domain, users with that email domain must use SSO. Email/password sign-in and password reset are disabled for them. Request this flag when you submit the IdP details to Support, or confirm it with your EKB admin if it is managed in-product for your deployment.

## What to send Support

| Field                   | Example                                |
| ----------------------- | -------------------------------------- |
| **Provider**            | Okta, Azure AD, PingIdentity, …        |
| **Enterprise ID**       | `company.com` (email domain)           |
| **Metadata URL** or XML | IdP federation metadata                |
| **SSO Sign-In Only**    | Optional — require SSO for that domain |

## Related

* [Okta SSO](/general/authentication/okta-sso)
* [Azure AD SSO](/general/authentication/azure-ad-sso)
* [Custom SSO](/general/authentication/custom-sso)
* [Team SSO](/my-account/team-sso)
* [Account Settings](/my-account/account-settings) (team “allow only SSO” style controls, when available)