> For the complete documentation index, see [llms.txt](https://docs.zerve.ai/zerve-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zerve.ai/zerve-docs/administration/saml-sso.md).

# SAML single sign-on

Set up SAML single sign-on so your team signs in to Zerve through your identity provider.

With **single sign-on (SSO)**, people in your organization sign in to Zerve through your company's identity provider, such as Microsoft Entra ID (Azure AD), Okta or Google Workspace, instead of a separate Zerve password. Anyone signing in with an email address on your domain is sent to your identity provider.

Set up SSO in **Settings → SSO**. You need to be an organization admin, and you'll need someone who can configure your identity provider.

{% hint style="info" %}
SSO may not be available on every plan. If you don't see **SSO** in Settings, contact Zerve.
{% endhint %}

## Before you start

You'll need:

* The **email domain** your team signs in with, such as `acme.com`
* Admin access to your identity provider, or someone who has it
* Your identity provider's **SAML metadata URL**, which you'll get during setup

## Set up SSO

{% stepper %}
{% step %}

### Create the connection in Zerve

In **Settings → SSO**, create a new connection. Enter:

* A **name** for the connection
* The **email domain** to send through SSO
* The **provider type**: **SAML**, or **Azure AD** if you use Microsoft Entra ID
  {% endstep %}

{% step %}

### Copy Zerve's details

Zerve shows two values. Copy them:

* **Entity ID**
* **ACS URL** (the Assertion Consumer Service URL)
  {% endstep %}

{% step %}

### Configure your identity provider

In your identity provider, create a new SAML application for Zerve, and enter the Entity ID and ACS URL from Zerve.

Assign the application to the people or groups who should have access.
{% endstep %}

{% step %}

### Give Zerve your identity provider's metadata

Copy your identity provider's **metadata URL** for the new application, and paste it into Zerve.

If your identity provider sends people's email address and name in non-standard claims, tell Zerve which claims to use for **email** and **name**.
{% endstep %}

{% step %}

### Finish

Zerve fetches and checks your identity provider's metadata straight away. If it can reach the URL and the metadata is valid, SSO is set up. If not, you'll see an error; check the URL is correct and reachable from the internet, then try again.
{% endstep %}
{% endstepper %}

## After setup

People signing in with an email address on your domain are sent to your identity provider. An organization can have one SSO connection.

## Multi-factor authentication

People who don't sign in through SSO can turn on **multi-factor authentication** for their own account. With SSO, multi-factor authentication is handled by your identity provider.

## Self-hosted Zerve

If your organization runs its own Zerve install, it can use your own OIDC identity provider instead. See [Self-managed installs](/zerve-docs/self-hosting/self-managed.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.zerve.ai/zerve-docs/administration/saml-sso.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.