> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/administration/security/admin-sso.md).

# Admin SSO

## Overview

You can use your preferred Identity Provider (IdP) to access Material's Admin console. This guide provides the steps necessary to set up SAML and use your identity provider to login.

### Configure <a href="#h-configure" id="h-configure"></a>

#### Prerequisites <a href="#h-prerequisites" id="h-prerequisites"></a>

* Required Roles: Material Super Admin or Tenant Admin
* Admin access to your preferred authentication provider

#### Enable <a href="#h-enable" id="h-enable"></a>

1. Navigate to Admin Console within Settings.

Now follow the IdP specific instructions below to configure Admin SSO with your identity provider.

<details>

<summary>Google Workspace SAML</summary>

* In a new tab, navigate to the Web and mobile apps page in the Google Admin Console.
* Click Add App, then Add custom SAML app.
* Name the application "Material Admin SSO".
* Click Continue.
* On the Google Identity Provider details page, use Option 1: Download Metadata.
* In Material's Admin Console enter the downloaded XML in the configuration dialog. Click Save.
* On the Google Identity Provider details page, Click Continue.
* Enter the following Service Provider Details
  * ACS URL: Use the value provided in Material (SSO Url)
  * Entity ID: Use the value provided in Material (Entity ID)
  * Name ID format: EMAIL
* Click Continue.
* Don’t add any Attribute Mappings and click Finish.
* You will be redirected to the page for the SAML App you just created.
* Click User access.
* In the left column, select "All users in this account".
* Confirm the Service Status is set to "OFF for everyone".
* Click Save.
* In the left column, use either Groups or Organization Units to find and designate a user population should be able to sign in to Material's Admin console.
* Select the Group or OU.
* Set the Service Status to ON.
* Click Save.

</details>

<details>

<summary>Microsoft 365 SAML</summary>

* In a new tab, navigate to the [Azure Active Directory](https://aad.portal.azure.com/) page in the Microsoft 365 Admin console (In the Microsoft 365 Admin console, go to Home > Show All > Azure Active Directory).
* Under Manage > Enterprise applications, click + New Application.
* Click + Create your own application.
  * Name the application "Material Admin SSO"
  * Select Integrate any other application you don’t find in the gallery (Non-gallery)
  * Click Create
* You will be redirected to the page for the app you just created.
* Under Manage > Properties, confirm Visible to users? is set to Yes.
* Click Save.
* Under Manage > Single sign-on, click SAML
* Edit the Basic SAML Configuration as follows
  * Identifier (Entity ID): Add the value provided in Material **(Entity ID)**.
  * Reply URL (Assertion Consumer Service URL): Use the value provided in Material **(SSO Url)**.
* Click Save.
* Edit the Attributes & Claims as follows:
  * Unique User Identifier (Name ID): Change the value of the Source attribute from **user.userprincipalname** to **user.mail**
* Click Save.
* Navigate back to SAML-based Sign-on. Alternately click Enterprise applications > All applications > "Material Admin SSO" > under Manage > Single sign-on.
* Under SAML Signing Certificate, download the Federation Metadata XML and enter the downloaded XML in the configuration dialog in Material. Click Save.
* Back in Azure, on the left column click Manage > Users and groups, find and designate a user population should be able to sign in to Material's Admin console.

</details>

<details>

<summary>Okta SAML</summary>

* In a new tab, sign in to the Okta Admin Console, navigate to **Applications > Applications**.
* Click **Create App Integration**.
* In the **Create a new app integration** dialog, choose *SAML 2.0* and click **Next**.
* Name the application "Material Admin SSO" and click **Next**.
* In Configure SAML step, in the **SAML Settings** section, enter values for:
  * **Single sign on URL**: Use the **SSO Url** value provided back in Material.
  * **Audience URI**: Use the **Entity ID** value provided back in Material.
* Click **Next**
* On the last page, select "I'm an Okta customer adding an internal app", and click **Finish**.
* Under the **Sign On** tab:
  * To the right of the **SAML Signing Certificates** section, click the **View SAML setup instructions** button.
  * Copy the IdP metadata from the bottom of the screen.
  * Paste the displayed metadata in the **Identity Provider (IdP) XML Metadata** dialog in Material.
  * Click Save in Material.
* In Okta, navigate to the application and select the **Assignments** tab:
  * Assign the "Material Admin SSO" application to the relevant user population that should be able to sign in to Material's Admin console.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/administration/security/admin-sso.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.