> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise SSO

> Connect SAML so your team signs in with corporate credentials, and map IdP groups to Cobalt roles.

# Enterprise SSO

Connect your identity provider so administrators sign in to the console with your
organization's credentials instead of a Cobalt password. Cobalt brokers the
connection — you provide your IdP's metadata, paste two values back into your IdP,
and you're done.

<Note>
  **SAML 2.0** is supported today (Okta, Microsoft Entra ID / Azure AD, Google
  Workspace, OneLogin, Ping, and any SAML IdP). OIDC connections for
  **administrator** sign-in are coming; the console shows OIDC as "coming soon."
  (This is separate from **end-user** federated identity, where verifying an
  OIDC/JWT token from your IdP *is* supported — see
  [End-user identity](/identity/end-user-identity).) SSO is available on plans that
  include it — talk to us if you don't see it.
</Note>

SSO governs **administrator** sign-in. It does not, by itself, sign in end users —
for that, see [End-user identity](/identity/end-user-identity).

## Connect a SAML provider

<Steps>
  <Step title="Open Settings → Single sign-on">
    Requires the **Admin** or **Owner** role. Choose **SAML** and your provider.
  </Step>

  <Step title="Enter your IdP metadata URL">
    Paste the metadata URL (or endpoint) from your IdP's SAML app. Cobalt reads
    your signing certificate and endpoints from it — you never upload a cert by
    hand.
  </Step>

  <Step title="Copy the service-provider values into your IdP">
    Cobalt shows two values to paste into your IdP's SAML app:

    * **ACS URL** (Assertion Consumer Service / reply URL)
    * **Entity ID** (audience / SP identifier)
  </Step>

  <Step title="Map attributes">
    Ensure your IdP sends **email**, and — if you want role mapping — a **groups**
    attribute (see below). First name / last name are optional.
  </Step>

  <Step title="Activate and test">
    Activate the connection, then sign in from an incognito window with a test
    account to confirm the round-trip. The connection shows **Active** once it's
    verified.
  </Step>
</Steps>

Provider-specific cheat sheet for the values you'll paste into the IdP:

| Your IdP app field                    | Paste Cobalt's… |
| ------------------------------------- | --------------- |
| Single sign-on URL / ACS / Reply URL  | **ACS URL**     |
| Audience URI / Entity ID / Identifier | **Entity ID**   |

## Map groups to roles

Instead of assigning [roles](/identity/roles-and-team) by hand, let your directory
drive them.

<Steps>
  <Step title="Send a groups attribute from your IdP">
    Configure your SAML app to release the user's group memberships as a
    **groups** attribute.
  </Step>

  <Step title="Add mappings in Settings → Single sign-on">
    Add rows mapping an IdP group name to one or more Cobalt roles — e.g.
    `cobalt-admins → Admin`, `finance → Billing`.
  </Step>
</Steps>

How it behaves:

* **New assignments and changes apply at the user's next SSO sign-in** (that's
  when your IdP sends fresh group claims).
* **Removals and de-provisioning apply automatically** — if someone is removed
  from a mapped group or off-boarded, their elevated access is revoked without
  waiting for them to sign in.
* **Unmapped users default to Member** (least privilege).
* **Owner is never assignable by mapping**, and Cobalt never strips the workspace's
  last Admin/Owner.

<Tip>
  No mappings? Then SSO only handles sign-in, and you assign roles manually on the
  Team page. Group mapping is optional.
</Tip>

## Keep or disable password sign-in

Once SSO is active you can record whether email/password (and social) sign-in
should remain available for your team. Today this setting is **advisory** — it
documents your policy and drives console messaging, but existing password
sign-in isn't blocked yet. Full enforcement is coming; until then, govern access
by removing members who shouldn't retain password credentials.

## Remove a connection

Deleting the SAML connection returns the workspace to email/password sign-in. Any
end-user widget mode that depended on SSO is disabled until reconfigured.

## Related

* Auto-provision the users themselves: [SCIM provisioning](/identity/scim).
* Roles and what each can do: [Roles & team](/identity/roles-and-team).