> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure SSO
> Set up Single Sign-On with Profound over SAML or OIDC
Set up Single Sign-On (SSO) with Profound over Security Assertion Markup Language (SAML) or OpenID Connect (OIDC). Profound supports various identity providers (IdPs), including Microsoft Azure AD, Google Workspace, Okta, and any custom SAML-compliant or OIDC-compliant IdP.
SSO is available for customers on the Enterprise plan. Setup requires the [Admin role](/platform-config/people/roles-and-permissions) in your Profound organization.
## Before you start
You'll need:
* The Admin role in your Profound organization
* Administrative access to your IdP
* The domain you want to enable for SSO
* An account in your IdP on the SSO domain, for running the test sign-in
* Access to your DNS records to verify domain ownership
## Setup steps
1. In Profound, select your organization name at the top left of the screen, then select **Settings**.
2. Select **Enterprise Setup** under **Organization** in the left navigation sidebar. The **Single Sign-On** card shows your current SSO status and verified domains.
3. Select **Configure SSO** to open the configuration portal.
Follow the domain verification step in the portal and add the record it provides to your DNS. Verification confirms your organization owns the domain and unlocks the rest of the configuration.
DNS changes can take up to 48 hours to propagate, and usually appear within 15 to 30 minutes. Select **Check status** on the **Enterprise Setup** page to refresh.
**Notes**:
* **Each domain gets its own verification value**, so add the record to the domain it was issued for. For example, a record issued for `www.example.com` belongs on `www.example.com`, and `example.com` needs the separate record issued for `example.com`. Add the record alongside any existing TXT records on the host instead of replacing them.
* **Verify the domain that appears in your users' email addresses**. For example, if your team signs in with `name@example.com` addresses, verify `example.com`, even if your IdP runs at `example.myidp.com`. Profound checks the email domain of each user who signs in against your verified domains, and rejects the sign-in when it doesn't match or when your organization has no verified domains.
* **Keep the verification record in your DNS after setup**. Profound rechecks it, so removing or changing it returns the domain to **Pending** and sign-in through your IdP stops working until the record is restored.
Select your IdP from the list of supported options. After you select it, the portal shows setup instructions specific to your provider.
If your provider isn't on the list, use the custom SAML or OIDC connection option.
The portal walks you through connecting your IdP to Profound. It shows the values to copy from Profound into your IdP, and the values to retrieve from your IdP and enter into the portal.
The values you exchange depend on your SSO protocol:
* Profound → IdP: the Authorized Redirect URI
* IdP → Profound: the Discovery Endpoint, Client ID, and Client Secret
* Profound → IdP: the ACS URL, Service Provider Entity ID, and Metadata URL
* IdP → Profound: the SSO URL, Entity ID, and X.509 Certificate
Follow the instructions shown in the portal for your specific IdP and protocol.
The final step in the portal validates your connection. Select **Test sign-in** to run a real sign-in through your IdP. The portal redirects you to your IdP, you sign in with an account on the domain you verified, and your IdP returns you to the portal with the result:
* **Test successful**: your IdP returned a valid response and the connection is configured correctly.
* **Test failed**: the portal shows the validation error and debugging steps. Repeat [Step 4](#step-4) to correct the connection values, then run the test again.
Run the test as many times as you need. The portal records each attempt in the **Sessions** list on its SSO screen. Select a session to see the request sent to your IdP and the response it returned. These details help when you troubleshoot with your IdP administrator or Profound's [customer support](mailto:support@tryprofound.com).
**Notes**:
* Testing happens in your own Profound organization, a separate test organization isn't needed.
* Running a test sign-in only affects the account you test with.
* Your team keeps signing in as usual until you enable SSO in the next step.
To start over with a different IdP or protocol, select **Reset Connection** in the portal and follow the prompts.
After the test passes, enable SSO for your domain directly from the portal. Back on the **Enterprise Setup** page, the status reads **SSO Enabled** and your domain is marked **Verified**. Select **Check status** to refresh.
After you enable SSO, Profound automatically directs users whose email addresses match your configured domains to your IdP for authentication.
## Notes
* Each Profound organization needs its own SSO connection.
* Subdomains can't use the same SSO connection as the root domain: each subdomain needs its own connection.
* Keep each domain's verification TXT record in place for as long as SSO is enabled for that domain.
* For SAML connections, renew your IdP signing certificate before it expires. The **Single Sign-On** card shows a warning as the expiry date approaches.
* Contact [customer support](mailto:support@tryprofound.com) if you need help during setup.