> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure SSO

> Set up Single Sign-On with Profound over SAML or OIDC

This guide explains how to set up Single Sign-On (SSO) with Profound over Security Assertion Markup Language (SAML) or OpenID Connect (OIDC). Profound supports various identity providers (IdPs), including Microsoft Azure AD, Google Workspace, Okta, and any custom SAML-compliant or OIDC-compliant IdP.

<Note>
  SSO is available for customers on the Enterprise plan. Setup requires the Admin role in your Profound organization.
</Note>

## Before you start

You'll need:

* The Admin role in your Profound organization
* Administrative access to your IdP
* The domain you want to enable for SSO
* Access to your DNS records to verify domain ownership

## Setup steps

<Steps>
  <Step title="Open the SSO configuration portal">
    Go to **Settings** in the settings icon menu at the bottom left of the platform.

    <img src="https://mintcdn.com/profound-37face47/KA2VQvbNybfiIidf/images/enterprise-connections/sso-settings-icon.png?fit=max&auto=format&n=KA2VQvbNybfiIidf&q=85&s=5476f3c3765b8cdf068a462770bff263" alt="Profound sidebar screenshot with the settings gear icon and the Settings menu option highlighted" width="2038" height="1038" data-path="images/enterprise-connections/sso-settings-icon.png" />

    Then select **Enterprise Setup** under **Organization** in the left navigation sidebar. The **Single Sign-On** card shows your current SSO status and verified domains. Select **Configure SSO** (or **Manage SSO**, if SSO is already set up) to open the configuration portal.

    <img src="https://mintcdn.com/profound-37face47/KA2VQvbNybfiIidf/images/enterprise-connections/sso-configure.png?fit=max&auto=format&n=KA2VQvbNybfiIidf&q=85&s=7ffcd1116e918e85a10ca092d912ffc3" alt="Enterprise Setup page screenshot showing the Single Sign-On card with the Configure SSO button highlighted" width="1760" height="1084" data-path="images/enterprise-connections/sso-configure.png" />
  </Step>

  <Step title="Verify your domain">
    Follow the domain verification step in the portal and add the record it provides to your DNS. Verification confirms your organization owns the domain and unlocks the rest of the configuration.
  </Step>

  <Step title="Select your identity provider">
    Select your IdP from the list of supported options. The portal tailors the setup experience to your IdP: once you make your selection, it shows step-by-step instructions specific to your provider.

    If your provider is not on the list, custom SAML or OIDC connection options are available.
  </Step>

  <Step title="Follow the IdP-specific instructions">
    The portal walks you through connecting your IdP to Profound. It shows the values to copy from Profound into your IdP, and the values to retrieve from your IdP and enter into the portal.

    The values you exchange depend on your SSO protocol:

    <Tabs>
      <Tab title="OIDC">
        * Profound → IdP: the Authorized Redirect URI
        * IdP → Profound: the Discovery Endpoint, Client ID, and Client Secret
      </Tab>

      <Tab title="SAML">
        * Profound → IdP: the ACS URL, Service Provider Entity ID, and Metadata URL
        * IdP → Profound: the SSO URL, Entity ID, and X.509 Certificate
      </Tab>
    </Tabs>

    Follow the instructions shown in the portal for your specific IdP and protocol.
  </Step>

  <Step title="Test and enable">
    The configuration portal includes a built-in test feature. Use it to verify the connection and the login flow before going live.

    Once the test passes, enable SSO for your domain directly from the portal. Back on the **Enterprise Setup** page, the status reads **SSO Enabled** and your domain is marked **Verified**. Select **Check status** to refresh.

    <img src="https://mintcdn.com/profound-37face47/KA2VQvbNybfiIidf/images/enterprise-connections/sso-success.png?fit=max&auto=format&n=KA2VQvbNybfiIidf&q=85&s=dc627643c2263f21df478dd6f75c7ff2" alt="Enterprise Setup page screenshot showing SSO Enabled status, a Verified domain, and the Check status button highlighted" width="1766" height="862" data-path="images/enterprise-connections/sso-success.png" />
  </Step>
</Steps>

After you enable SSO, users with email addresses matching your configured domains are automatically directed to your IdP for authentication.

## Notes

* SSO is configured per Profound organization: each organization needs its own connection.
* Subdomains cannot use the same SSO connection as the root domain: each subdomain needs its own connection.
* Contact [customer support](mailto:support@tryprofound.com) if you need assistance during setup.