> ## Documentation Index
> Fetch the complete documentation index at: https://ai-kb.automationanywhere.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Team SSO

> Connect your own identity provider for a team or sub-team

Team administrators can attach **their own** SAML identity provider configurations to a team — without waiting for a platform-wide SSO change by Automation Anywhere.

Open **My Account → Single Sign-On**.

> Connect your own identity provider for this team. If the team has a subdomain, the default configuration can be offered automatically to anyone signing in on that subdomain. If there is no subdomain, members use the **Login URL** for that configuration instead.

## Team SSO vs platform SSO

|                | **Platform SSO**                                    | **Team SSO**                                   |
| -------------- | --------------------------------------------------- | ---------------------------------------------- |
| Who configures | Typically Super Admin / AA Support                  | Team admin (and parent admins for descendants) |
| Scope          | Organization / instance-wide patterns               | One team (and how members reach that team)     |
| Docs           | [Single Sign-On (SSO)](/general/authentication/sso) | This page                                      |

Team SSO configurations live separately from the app-wide SSO path so they are not mixed up with platform providers.

## Add a configuration

1. Open **My Account → Single Sign-On**.
2. Select **New SSO configuration**.
3. Upload IdP metadata (or complete the fields your IdP requires).
4. Copy the generated values into your IdP:
   * **ACS URL (reply URL)** — also used as the SAML audience for this configuration
   * **Login URL** — where members start SSO for this team when not using subdomain auto-offer
5. Enable the configuration. Optionally mark it as the one to **use on this team's subdomain**.

Each configuration gets its **own** ACS URL/audience so two teams pointing at the same IdP cannot replay one another's assertions.

You can keep multiple configurations per team (up to **20**).

## Subdomain behavior

| Situation                                     | What members see                                                           |
| --------------------------------------------- | -------------------------------------------------------------------------- |
| Team **has** a subdomain and a default config | That IdP can be offered automatically on the subdomain                     |
| Team **has no** subdomain                     | No automatic offer — use the configuration's **Login URL**                 |
| Default marked but no subdomain               | UI notes that a subdomain is required for the default offer to take effect |

Subdomains for child teams are managed from [Sub-teams](/my-account/sub-teams).

## Who can manage Team SSO

| Actor             | Can manage                                   |
| ----------------- | -------------------------------------------- |
| Team Admin        | This team's SSO                              |
| Parent Team Admin | This team **and** descendant teams' SSO      |
| Super Admin       | All teams (when acting with admin authority) |
| Editor / Member   | No                                           |

## Related

* [Sub-teams](/my-account/sub-teams)
* [Account Settings](/my-account/account-settings) (SSO-only login and domain auto-add)
* [Platform SSO](/general/authentication/sso)