> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.markup.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.markup.ai/_mcp/server.

# Set Up SSO

> Connect your identity provider to Markup AI with SAML or OIDC. Self-service, no Markup AI engineer required.

> **Note**
>
> Single sign-on — including [attribute mapping](/admin/attribute-mapping) and [SCIM provisioning](/admin/scim) — is available on the **Enterprise plan**. On other plans, members sign in with a social login or an email and password.

Single sign-on lets your team sign in to Markup AI with your identity provider (IdP). Setup is **self-service**: you exchange metadata with your IdP, then confirm how Markup AI reads group membership.

You can add **more than one connection** — for example SAML for your parent company and OIDC for an acquired subsidiary. Each connection has its own configuration.

## What you need

* The **Administrator** role in your organization.
* Access to your IdP's admin console (Okta, Microsoft Entra ID, Google Workspace, JumpCloud, ADFS, PingFederate, or any SAML 2.0 / OIDC provider).

## Add a connection

#### Open Single Sign-On settings

In the [console](https://console.markup.ai), go to **Single Sign-On**. You'll see any existing connections and their status.

![Single Sign-On connections list with JumpCloud and Azure AD connections](/_fern-img/260f6151413ce5c1421acf5e69debecf42cf7126523b77f2d5bdef484af2ee77.webp)

#### Create the connection

Select **New connection**, choose **SAML** or **OIDC**, and give it a friendly name your team will recognize. Select **Continue to setup** — the IdP setup form opens in a new browser tab.

![New SSO connection dialog with SAML and OIDC options](/_fern-img/8dad0770c785a32bfffdb43d1fdf2ec5b2679ea4489e067b12f8acb7355a863c.webp)

#### Exchange metadata with your IdP

In the hosted form, pick your provider for step-by-step instructions. You'll create an application in your IdP and exchange metadata — copy the **Single Sign-On URL** and **Audience URI** into your IdP, and provide your IdP's metadata back. This step only configures the connection between your IdP and Markup AI; no user data changes yet.

![Hosted SSO setup showing Okta instructions and the SP metadata URLs](/_fern-img/0dd30ed0bdcc16ee6b2c5c01a7d57cf4f45aade1036414124a22eb742aa66e1c.webp)

> **Tip**
>
> No provider listed? Choose **Custom SAML** (or OIDC) and enter the connection details by hand.

#### Set the sign-in domains

Back in the console, open the connection and add the email **domains** that should sign in through it on the **Domains** tab. Users with a matching domain are routed to this connection.

![Connection detail page with the Domains tab selected and a verified domain](/_fern-img/a4a62a24b0e337ef2efb9a03fb45f46349d70f904ec827f30c16a838b24a16c2.webp)

#### Map your groups

On the connection's **Attribute mapping** tab, tell Markup AI which claim carries group membership and how to read it. This is what turns your IdP's groups into Markup AI groups — see [Attribute Mapping](/admin/attribute-mapping).

## Editing a connection later

Open any connection from **Single Sign-On** to change its domains, attribute mapping, or SCIM settings. To re-run the IdP metadata exchange, use the connection's **Actions** menu — it reopens the hosted setup form for the existing connection rather than creating a new one.

## Next steps

#### [Attribute Mapping](/admin/attribute-mapping)

Map IdP claims to Markup AI groups.

#### [SCIM Provisioning](/admin/scim)

Provision users and groups ahead of first login.