> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1.md).

# Authenticate users using SSO

Configure SAML 2.0 single sign-on for Cortex XDR users.

Cortex XDR supports SAML 2.0 single sign-on (SSO). Users can authenticate through an Identity Provider (IdP), such as Okta, PingOne, or Microsoft Entra ID.

Use SSO to enforce your organization's MFA, identity verification, deprovisioning, and conditional access policies.

{% hint style="info" %}

### Note

You need the Instance Administrator or Account Admin role.

Users must sign in using the tenant FQDN. Configure the IdP relay state for direct IdP sign-in.

Configure each tenant separately when you use multiple tenants.
{% endhint %}

### Configure SSO

1. In Cortex XDR, go to **Settings** → **Configurations** → **Access Management** → **Authentication Settings**.
2. To add another provider, click **Add SSO Connection**.
3. Configure the required **General parameters** and **IdP Attribute Mapping** values.
4. Optionally configure **Advanced Settings**.
5. Click **Save**.

Cortex XDR needs these IdP attributes in the SAML token:

* Email
* Group membership
* First name
* Last name

Attribute names are case-sensitive. The IdP must sign both the SAML response and assertion.

### Map groups

1. Go to **Settings** → **Configurations** → **Access Management** → **User Groups**.
2. Edit a user group.
3. Enter the IdP group values in **SAML Group Mapping**.
4. Save your changes.

{% hint style="info" %}

### Tip

Keep at least one Customer Support Portal user as a backup administrator.
{% endhint %}

For provider-specific procedures, see the Okta and Microsoft Entra ID setup pages.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.