Authenticate users using SSO

Configure SAML 2.0 single sign-on for Cortex XDR users.

Cortex XDR supports SAML 2.0 single sign-on (SSO). Users can authenticate through an Identity Provider (IdP), such as Okta, PingOne, or Microsoft Entra ID.

Use SSO to enforce your organization's MFA, identity verification, deprovisioning, and conditional access policies.

Note

You need the Instance Administrator or Account Admin role.

Users must sign in using the tenant FQDN. Configure the IdP relay state for direct IdP sign-in.

Configure each tenant separately when you use multiple tenants.

Configure SSO

1. In Cortex XDR, go to Settings → Configurations → Access Management → Authentication Settings.
2. To add another provider, click Add SSO Connection.
3. Configure the required General parameters and IdP Attribute Mapping values.
4. Optionally configure Advanced Settings.
5. Click Save.

Cortex XDR needs these IdP attributes in the SAML token:

• Email
• Group membership
• First name
• Last name

Attribute names are case-sensitive. The IdP must sign both the SAML response and assertion.

Map groups

1. Go to Settings → Configurations → Access Management → User Groups.
2. Edit a user group.
3. Enter the IdP group values in SAML Group Mapping.
4. Save your changes.

Tip

Keep at least one Customer Support Portal user as a backup administrator.

For provider-specific procedures, see the Okta and Microsoft Entra ID setup pages.