> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1.md).

# Authenticate users using SSO

Cortex XDR supports SAML 2.0 single sign-on (SSO). Users can authenticate through an Identity Provider (IdP), such as Okta, PingOne, or Microsoft Entra ID.

Use SSO to enforce your organization's MFA, identity verification, deprovisioning, and conditional access policies.

{% hint style="info" %}

### Note

You need the Instance Administrator or Account Admin role.

Users must sign in using the tenant FQDN. Configure the IdP relay state for direct IdP sign-in.

Configure each tenant separately when you use multiple tenants.
{% endhint %}

### Configure SSO

1. In Cortex XDR, go to **Settings** → **Configurations** → **Access Management** → **Authentication Settings**.
2. To add another provider, click **Add SSO Connection**.
3. Configure the required **General parameters** and **IdP Attribute Mapping** values.
4. Optionally configure **Advanced Settings**.
5. Click **Save**.

Cortex XDR needs these IdP attributes in the SAML token:

* Email
* Group membership
* First name
* Last name

Attribute names are case-sensitive. The IdP must sign both the SAML response and assertion.

### Map groups

1. Go to **Settings** → **Configurations** → **Access Management** → **User Groups**.
2. Edit a user group.
3. Enter the IdP group values in **SAML Group Mapping**.
4. Save your changes.

{% hint style="info" %}

### Tip

Keep at least one Customer Support Portal user as a backup administrator.
{% endhint %}

For provider-specific procedures, see the Okta and Microsoft Entra ID setup pages.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.