> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1/set-up-okta-as-the-identity-provider-using-saml-2.0.md).

# Set up Okta as the Identity Provider Using SAML 2.0

This procedure configures Okta to authenticate Cortex XDR users. Okta screens and procedures can change. Review the [Okta app integration documentation](https://help.okta.com/oie/en-us/content/topics/apps/apps_apps.htm) for current details.

You need Cortex XDR access and the Account Admin or Instance Administrator role.

{% stepper %}
{% step %}

### Configure Okta groups

Assign users to Okta groups that match Cortex XDR user groups. Use a common identifier in group names, such as `Cortex XDR`.

Record each Okta group and its corresponding Cortex XDR user group.
{% endstep %}

{% step %}

### Copy Cortex XDR values

In Cortex XDR, go to **Settings** → **Configurations** → **Access Management** → **Single Sign-On**.

Expand **SSO Integration**. Copy **Single Sign-On URL** and **Audience URI (SP Entity ID)**.
{% endstep %}

{% step %}

### Configure the Okta application

Create a Cortex XDR SAML application in Okta. Enter the copied values as **Single sign-on URL** and **Audience URI (SP Entity ID)**.

Set **Default RelayState** to the Audience URI. Configure Okta to sign both the response and assertion.

Configure these SAML attributes:

* Email address
* Group membership, using `memberOf`
* First name and last name

Filter groups using your chosen identifier. Record the exact attribute names.
{% endstep %}

{% step %}

### Copy Okta identity values

On the application **Sign On** tab, select **View SAML setup instructions**.

Copy **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**, and the **X.509 Certificate**.
{% endstep %}

{% step %}

### Configure Cortex XDR

In the Cortex XDR **SSO Integration** settings, map these values:

* Okta **Identity Provider Single Sign-On URL** → **IdP SSO URL**
* Okta **Identity Provider Issuer** → **IdP Issuer ID**
* Okta **X.509 Certificate** → **X.509 Certificate**

Enter the recorded attributes in **IdP Attributes Mapping**. Names must match exactly. Save your changes.
{% endstep %}

{% step %}

### Map groups and test access

Map each Okta group in the target Cortex XDR user group's **SAML Group Mapping** field. Separate multiple groups with commas.

Open the Cortex XDR tenant URL and select **Sign-In with SSO**. Verify that the user receives the expected roles.
{% endstep %}
{% endstepper %}

{% hint style="info" %}

### Note

SAML users must sign in at the Cortex XDR tenant URL. They cannot sign in through Cortex Gateway.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1/set-up-okta-as-the-identity-provider-using-saml-2.0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.