# Enterprise SSO (SAML)

> Sign your team in with your own identity provider over SAML 2.0: the values you exchange with LevelFour, the attributes your IdP must send, and how to set it up in Google Workspace.

Source: https://docs.levelfour.ai/account/sso


Enterprise SSO lets your team sign in to the LevelFour dashboard with your organization's identity provider (IdP) over SAML 2.0, instead of individual email or social logins. Once enabled, LevelFour routes anyone with an email address on your verified domain to your IdP to authenticate.

SSO is an enterprise feature. To enable it, contact your LevelFour representative or email [support@levelfour.ai](mailto:support@levelfour.ai) with your identity provider and the email domains your team signs in with.

## Supported identity providers

* Google Workspace
* Microsoft Entra ID (formerly Azure AD)
* Okta
* Any SAML 2.0-compatible identity provider

## How it works

Setting up SAML SSO is a one-time exchange of configuration between LevelFour (the service provider) and your identity provider:

1. You tell LevelFour your IdP and email domain.
2. LevelFour creates a connection for your domain and sends you the **ACS URL** (Assertion Consumer Service URL) and the **Entity ID** (service provider identifier).
3. You create a SAML application in your IdP using those values and map a few user attributes.
4. You send back your IdP SSO URL, your IdP Entity ID, and your X.509 signing certificate, or the full IdP metadata XML.
5. LevelFour activates the connection and tests it with you.

> **Note**
>
> Your ACS URL and Entity ID are unique to your organization and are shared with you privately during setup. They are not published here.

LevelFour routes sign-ins by email domain, so your existing logins keep working until it activates the connection.

## Required attribute mapping

Your IdP must send these attributes in the SAML assertion:

| User attribute | App attribute name | Required |
| -------------- | ------------------ | -------- |
| Email address  | `mail`             | Yes      |
| First name     | `firstName`        | No       |
| Last name      | `lastName`         | No       |

> **Warning**
>
> Set the Name ID to the user's primary email and the Name ID format to **EMAIL**. The app attribute names must match the table exactly.

## Set up Google Workspace

These steps use Google Workspace.

### Create the SAML app

In the Google Admin console, go to **Apps > Web and mobile apps**, then click **Add app > Add custom SAML app**. Enter an app name (for example, "LevelFour") and click **Continue**.

### Save your IdP details

On the **Google Identity Provider details** page, download the **IdP metadata**, or copy the **SSO URL** and **Entity ID** and download the **Certificate**. You will send these to LevelFour. Click **Continue**.

### Enter the service provider details

In **Service Provider Details**, enter the **ACS URL** and **Entity ID** LevelFour sent you. Click **Continue**.

### Set the Name ID and map the attributes

Set the **Name ID format** to **EMAIL** and the **Name ID** to **Basic Information > Primary email**.

Under **Attributes**, click **Add mapping** and map each Google directory field to its app attribute name:

* **Basic Information > Primary email** to `mail`
* **Basic Information > First name** to `firstName`
* **Basic Information > Last name** to `lastName`

Click **Finish**.

### Turn the app on

Open the app, go to **User access**, select **On for everyone**, and click **Save**.

### Send LevelFour your IdP details

Send LevelFour the IdP metadata (or the SSO URL, Entity ID, and certificate) you saved from the **Google Identity Provider details** page.

Once LevelFour receives your IdP details, it loads them into your connection, tests a sign-in with one user on your domain, then activates SSO for the whole domain.

## Other identity providers

The flow is identical for other providers. Create a SAML application in your IdP using the ACS URL and Entity ID LevelFour sends you, apply the same [attribute mapping](#required-attribute-mapping), and return your IdP metadata.

> **Note**
>
> Send your IdP metadata and signing certificate to your LevelFour representative through a secure channel, not a public forum.

## Next

* [Members and roles](/account/members-and-roles) is what each person can do once they are signed in
* [API keys](/account/api-keys) is how code and CI reach LevelFour without a person signing in