> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso.md).

# Get Started with SAML SSO

Enable single sign-on (SSO) on Prisma Cloud using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML), such as Okta, Microsoft Active Directory Federation Services (AD FS), Azure Active Directory (AD), Google, or OneLogin. You can configure only one IdP for all the cloud accounts that Prisma Cloud monitors.

To access Prisma Cloud using SSO, every administrative user requires a local account on Prisma Cloud. You can either [Add Administrative Users On Prisma Cloud](/content-collections/administration/add-prisma-cloud-users.md) to create the local account in advance of enabling SSO, or use Just-In-Time (JIT) Provisioning on the SSO configuration on Prisma Cloud if you prefer to create the local account automatically. With JIT Provisioning, the first time a user logs in and successfully authenticates with your SSO IdP, the SAML assertions are used to create a local user account on Prisma Cloud.

To enable SSO, you must first complete the setup on the IdP. Then, login to Prisma Cloud using an account with System Admin privileges to configure SSO and redirect login requests to the IdP’s login page, so that your Prisma Cloud administrative users can log in using SSO. After you enable SSO, you must access Prisma Cloud from the IdP’s portal.

To avoid account lockout while making configuration changes, enable administrative users to log into the console with both local authentication credentials on Prisma Cloud and SSO access by adding them to the SSO bypass list.

1. Decide whether you want to first add [Add Administrative Users On Prisma Cloud](/content-collections/administration/add-prisma-cloud-users.md) or you prefer to add users on the fly with JIT Provisioning when you configure SSO on Prisma Cloud.

   If you want to enable JIT provisioning for users, [Create Prisma Cloud Roles](/content-collections/administration/create-prisma-cloud-roles.md) before you continue to the next step. When you configure SSO on the IdP, you must attach this role to the user‘s profile so that the user has the appropriate permissions and can monitor the assigned cloud accounts on Prisma Cloud.
2. Copy the Audience URI, for Prisma Cloud, which users need to access from the IdP.
   1. Log in to Prisma Cloud and select **Settings > Access Control > SSO** and click **SAML**.
   2. Copy the **Audience URI (SP Entity ID)** value. This is a read-only field in the format: <https://app.prismacloud.io?customer=\\><string> to uniquely identify your instance of Prisma Cloud. You require this value when you configure SAML on your IdP.

      <figure><img src="/files/G7E8QUf6D7YVWR6zdmuo" alt="settings sso 1"><figcaption></figcaption></figure>
3. Set up the Identity Provider (Okta, Microsoft ADFS, Azure AD, Google, or OneLogin) for SSO as described in the next section.

Use your pre-defined Access URL for login, alternatively use your [federated login URL](/content-collections/get-started/access-prisma-cloud.md#id3c964e17-24c6-4e7c-9a47-adae096cc88d).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.