Setting up single sign-on

Before enabling single sign-on, confirm the identity provider supports the protocol and claims required by your organisation. For SAML, prepare the issuer, SSO URL, certificate and stable user identifier. For SCIM, prepare a dedicated provisioning credential and define which groups may be provisioned. Assign at least two administrators before enforcing SSO and test with a small group. Keep a documented recovery path for an administrator account that is not dependent on the new identity-provider configuration. After the test succeeds, enforce the policy for the intended organisation and review sign-in and provisioning events. Do not paste private certificates or credentials into support tickets.