--- title: "Configure Single-Sign On (SSO) for Sanas App/ Portal" slug: "configure-single-sign-on-on-sanas-app-portal" updated: 2026-04-07T14:16:30Z published: 2026-04-07T14:16:30Z canonical: "help.sanas.ai/configure-single-sign-on-on-sanas-app-portal" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.sanas.ai/llms.txt > Use this file to discover all available pages before exploring further. # Configure Single-Sign On (SSO) for Sanas App/ Portal ### Introduction Configure Single Sign-On (SSO) to allow users to authenticate on the Sanas Portal and the Sanas App using your organization's existing Identity Provider (IdP). Sanas uses the SAML 2.0 protocol to integrate with your IdP for authentication and access validation. --- ### How it works SSO follows the following workflow to authenticate users: 1. The user navigates to the Sanas Portal or App. 2. User authentication: - **Sanas Portal**: User selects the SSO option on the login screen to initiate authentication. - **Sanas App**: User gets automatically redirected for authentication upon the Sanas App launch. 3. The user is redirected to the organization's IdP and follows the on-screen instructions to complete authentication. 4. Upon successful verification, the user is redirected back to Sanas with authorized access. > [!NOTE] > *Note: The user must exist on the integrated IdP.* #### Automatic User Creation Automatic User Creation is an additional feature that works alongside Auto-Activation and SSO to eliminate the requirement of manually adding users to the Portal. When Automatic User Creation is enabled, Sanas checks whether the user exists on the Portal and acts accordingly: - **If the user exists**, the user is granted access to the Sanas App. - **If the user does not exist**, a new user account is created on the Portal, and the user is granted access to the Sanas App. Newly created users are mapped to a Group based on the Installer ID configured on their computer. Installer IDs are unique Group identifiers found on each group's [**Get Sanas**](https://portal.sanas.ai/get-sanas) page. There are two types: - **Group Installer ID** — New users are added to the specific group associated with this ID. - **Account Installer ID** — New users are added to the Default Group. --- ### Before you begin - For Portal configuration, ensure your Portal role has **Group Settings** and **Account Settings: Full access**. - If configuring SSO for Sanas App users, ensure the Installer ID has been updated on each user's machine during app installation. If not, see [Update Installer ID](/portalv3/docs/update-installer-id-on-the-sanas-app-user-s-computer) for instructions. - Ensure the Auto-provisioning is enabled on the intended groups. Navigate to **Settings** > **Configuration** > **Application Authentication** > Ensure **SSO or Auto-activation** is configured > Ensure the **Automatic User Creation** toggle is enabled**.** ![](https://cdn.document360.io/9bc36e9c-f402-4213-b56f-4ecdf805bb1a/Images/Documentation/image(699).png) - Ensure you have administrative privileges on your IdP platform to complete the integration. - Ensure all intended users are added to the IdP before enabling SSO. - Ensure all intended Portal users are added to the Sanas Portal before enabling SSO. See [Manage Portal Users](/portalv3/docs/invite-portal-admins#invite-portal-users) for instructions. --- ### Configure SSO Follow the steps below to configure SSO: **Step 1: Gather integration details from the Sanas Portal** 1. Log in to the Sanas Portal with your credentials. 2. Navigate to **Settings > Configuration > SSO Settings**. 3. Click **Add SSO Provider**. ![](https://cdn.document360.io/9bc36e9c-f402-4213-b56f-4ecdf805bb1a/Images/Documentation/image(700).png) 4. Enter your IdP name. 5. Copy the following details and save them securely — you'll need these to complete the integration on your IdP: - **Identifier** - **Reply URL** ![](https://cdn.document360.io/9bc36e9c-f402-4213-b56f-4ecdf805bb1a/Images/Documentation/image(701).png) 6. **Gather integration details from the Portal.** 1. Log in to the Sanas Portal with your credentials. 2. Navigate to **Settings** > **Configuration** > **SSO** **Settings**. 3. Click **Add SSO provider**. ![Settings page displaying SSO configuration options and no existing connections.](https://cdn.document360.io/9bc36e9c-f402-4213-b56f-4ecdf805bb1a/Images/Documentation/Untitled 4(5).png) 4. Enter an SSO name. 5. Copy the following details and save them securely. We will need these details for the integration: - **Identifier** - **Reply URL** ![SAML configuration settings for identity provider with highlighted URLs and attributes.](https://cdn.document360.io/9bc36e9c-f402-4213-b56f-4ecdf805bb1a/Images/Documentation/Untitled 5(5).png) **Step 2: Complete the SAML 2.0 integration on your IdP** 1. Configure the SAML integration on your IdP platform using the **Identifier** and **Reply** **URL** copied in Step 1. 2. Map the following attributes during the SSO configuration: | Attribute | Value | Description | | --- | --- | --- | | `username` | UserID or Email | Unique identifier for the user. | | `name` | User name | Display name for the user. | 3. Once the integration is complete, download or copy the X-509 certificate metadata from your IdP. You'll need this to finalize the configuration on the Sanas Portal. Below are reference resources for common IdP platforms: - [Okta](https://developer.okta.com/docs/guides/build-sso-integration/saml2/main/) - [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso) **Step 3: Complete the SSO configuration on the Sanas Portal** 1. If you downloaded the X-509 certificate as a file, open it in a text editor and copy its content. 2. Return to the SSO Settings page on the Sanas Portal and paste the certificate content. ![Configuration settings for SSO authentication, including SAML and user attributes.](https://cdn.document360.io/9bc36e9c-f402-4213-b56f-4ecdf805bb1a/Images/Documentation/Untitled 6(5).png) 3. Click **Save**. 4. *(Optional)* Enable the **Lock Configuration** toggle to prevent subgroups from modifying the SSO provider integration. See [Lock Configuration](/portalv3/docs/feature-and-configuration-management) to learn more. **Step 4: Configure the authentication mode** After integrating the IdP, set SSO as the authentication mode: **For Sanas App user** 1. Select a group on the Group Tree for which you want to enable SSO authentication. Alternatively, select **Account** to apply SSO across all groups. 2. Navigate to **Settings > Configuration > Application Authentication**. 3. Select **SSO** from the list. 4. Click **Save** to apply the changes. 5. Ensure the **Automatic User Creation** toggle is enabled**.** ![](https://cdn.document360.io/9bc36e9c-f402-4213-b56f-4ecdf805bb1a/Images/Documentation/image(699).png) 6. *(Optional)* Enable the **Lock Configuration** toggle to enforce SSO as the authentication mode for all subgroups. See [Lock Configuration](/portalv3/docs/feature-and-configuration-management) to learn more. **For Portal user** 1. Select a group on the Group Tree for which you want to enable SSO authentication. Alternatively, select **Account** to apply SSO across all groups. 2. Navigate to **Settings > Configuration > Portal Authentication**. 3. Select your configured IdP from the list. 4. Click **Save** to apply the changes. --- ## Support **Need help?** Get in touch with our [Support Team](mailto:support@sanas.ai) for assistance.