> For the complete documentation index, see [llms.txt](https://docs.enate.net/enate-help/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enate.net/enate-help/builder/builder-2021.1/administration/sso-configuration.md).
# SSO Configuration
## SSO Configuration in Azure Active Directory
This article outlines the steps to follow to configure SSO in Azure Active Directory.
1\) Register a new application from the Enterprise Application | All Applications screen in the Azure Active Directory portal:
2\) Create a new non-gallery application. Including SSO or SAML in the name for this application can help to distinguish this from future GraphAPI applications for the same instance.
3\) Once the application has been created and the configuration pages are visible, navigate to Single sign-on under the Manage section and select SAML.
4\) Enate will supply an XML metadata file for each instance\*\*. This can be imported using the “Upload metadata file” button at the top of the page.
{% hint style="info" %}
\*\*Note that since Test Mode uses a different url to the standard Live Mode url, you will need to perform additional setup for SSO to work in Test Mode (if you wish users to access Test Mode with SSO). See '[**Update SAML Configuration to enable SSO in Test Mode**](#update-saml-configuration-to-enable-sso-in-test-mode)' for how to do this.
{% endhint %}
5\) Once imported, verify that the Identifier (Entity ID) and the Reply URL (Assertion Consumer Service URL) have been populated and the press Save.
6\) On the Single sign-on page with the newly populated Basic SAML Configuration section, you should be able to download the Federation Metadata XML under section 3, SAML Signing Certificate.
{% hint style="info" %}
**Note**: Enate typically uses the Email Address field configured for users within Enate to validate claims. This must match one of the supplied claims. User.userprincipalname or user.mail typically satisfy this but if you domain has multiple email addresses or situations where the userprincipalname may not always match the email address you may need to transform a claim to provide the correct information.
{% endhint %}
7\) This downloaded XML file should be supplied to Enate to complete the Enate side of the SSO configuration prior to testing.
8\) On the Properties page under the Manage section, you should change the “Visible to users?” setting to “No”.
9\) Depending on your configuration you can also change the “Assignment required?” to “No” and then manually assign Users to the application under the Users and groups page under the Manage section.
### Update SAML Configuration to enable SSO in Test Mode
Here are the steps to update your SAML configuration to enable SSO to run in Test Mode for a given Enate instance.
{% hint style="info" %}
Note: These steps assume that Live mode SSO has already been configured
{% endhint %}
1. Sign in to the Microsoft Entra Admin Center.
2. Navigate to Identity → Applications → Enterprise Applications.
3. Select the application used for Enate SSO.
4. Go to Single Sign-On and select SAML.
5. Under Basic SAML Configuration, click Edit.
6. Add the Test Mode Identifier (Entity ID) under the Identifier (Entity ID) section.
Example: If live mode url is:
[https://instancename.enate.app](https://instancename.enate.app/) (Default)
then you should add
[https://instancename.test.enate.app](https://instancename.test.enate.app/)
as new identifier
7. Add the Test Mode **Reply URL** (Assertion Consumer Service URL) under the Reply URL section.
Example: If live mode url is:
[https://instancename.enate.app/identity/e8dfge1f-9f8f-4464-93fd-b42369fdfb3c/saml2/Acs](https://instancename.enate.app/identity/e8ddde1f-9f8f-4464-93fd-b42369fdfb3c/saml2/Acs) (Default)
then you should add an an additional entry with the Test mode url, i.e.
[https://instancename.**test**.enate.app/identity/e8dfge1f-9f8f-4464-93fd-b42369fdfb3c/saml2/Acs](https://instancename.test.enate.app/identity/e8ddde1f-9f8f-4464-93fd-b42369fdfb3c/saml2/Acs) as an additional new identifier
8. Verify that the existing Live Mode URLs remain unchanged.
9. Click Save to apply the changes.
10. Back in Enate, test SSO login to both Live Mode and Test Mode to confirm successful authentication.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.enate.net/enate-help/builder/builder-2021.1/administration/sso-configuration.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.