> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chamelio.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On (SSO)

> Configure SSO for Chamelio using Auth0 with your organization's identity provider

Chamelio supports Single Sign-On (SSO) via Auth0. SSO lets your organization authenticate users through your existing identity provider (IdP), so employees sign in using corporate credentials.

## What SSO Enables

* Users sign in using your company's identity provider
* Password management and MFA are handled by your IdP
* User access is centrally managed by your IT or security team
* Faster and more secure login experience

## Supported Identity Providers

Chamelio supports any identity provider compatible with SAML 2.0 or OpenID Connect (OIDC), including:

* Okta
* Azure Active Directory (Entra ID)
* Google Workspace
* OneLogin
* Ping Identity

Contact [support@chamelio.ai](mailto:support@chamelio.ai) to confirm compatibility for other providers.

## Authentication Protocols

* **SAML 2.0**
* **OpenID Connect (OIDC)**

## User and Group Provisioning and Access

SSO controls authentication only. Authorization within Chamelio is managed separately — roles and permissions are configured within Chamelio regardless of how users authenticate.

Users must exist in Chamelio (or be allowed via auto-provisioning) to access the platform after SSO authentication.

## Setup Process

SSO is configured through a self-serve flow initiated by the Chamelio team:

<Steps>
  <Step title="Request an SSO setup link">
    Email [support@chamelio.ai](mailto:support@chamelio.ai) to request SSO setup. Chamelio generates and shares a secure configuration link.
  </Step>

  <Step title="Configure your identity provider">
    Your IT team uses the provided instructions to configure your IdP. For SAML, metadata or certificates are exchanged. For OIDC, client details are verified.
  </Step>

  <Step title="Test with a pilot user">
    Complete a login test with a pilot user before rolling out to the full team.
  </Step>

  <Step title="Enable SSO for your workspace">
    Once testing passes, SSO is enabled organization-wide.
  </Step>
</Steps>

## Common Questions

<Accordion title="Can SSO be enforced for all users?">
  Yes. Password-based login can be disabled once SSO is enforced, so all users must authenticate through your IdP.
</Accordion>

<Accordion title="Is MFA supported?">
  Yes. MFA is enforced through your identity provider, not Chamelio directly.
</Accordion>

<Accordion title="Can users still log in with email and password?">
  This depends on your configuration. Password-based login can be disabled once SSO is fully rolled out.
</Accordion>

<Accordion title="Is SCIM supported for automated user and group provisioning?">
  Yes. SCIM provisioning is available to automatically create, update, and deactivate users and groups in Chamelio when changes are made in your identity provider. See the provider-specific SCIM guides below, or contact [support@chamelio.ai](mailto:support@chamelio.ai) to get started.
</Accordion>

## SSO Setup Guides

Once you have your Self Service link, follow the guide for your identity provider:

<Cards>
  <Card title="Entra ID – OIDC" href="/guides/sso/entra-id-oidc">
    Set up SSO via OpenID Connect from Microsoft Entra ID
  </Card>

  <Card title="Entra ID – SAML" href="/guides/sso/entra-id-saml">
    Set up SSO via SAML from Microsoft Entra ID
  </Card>

  <Card title="Okta – OIDC" href="/guides/sso/okta-oidc">
    Set up SSO via OpenID Connect from Okta
  </Card>
</Cards>

## SCIM Provisioning Guides

To keep users and groups automatically synchronized with Chamelio, set up SCIM provisioning after completing SSO:

<Cards>
  <Card title="Entra ID – SCIM" href="/guides/sso/entra-id-scim">
    Configure automated user and group provisioning from Entra ID
  </Card>

  <Card title="Okta – SCIM" href="/guides/sso/okta-scim">
    Configure automated user and group provisioning from Okta
  </Card>
</Cards>

## Getting Started

To configure SSO, email **[support@chamelio.ai](mailto:support@chamelio.ai)**. Chamelio will generate a secure self-serve setup link for your IT or security team.