> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/settings/advanced-security-settings-overview/setting-up-single-sign-on-sso.md).
# Setting Up Single Sign On (SSO)
### CybaOps SSO Setup Guide (Microsoft / Azure AD)
This guide explains how to configure SAML 2.0 Single Sign-On (SSO) in CybaOps using Microsoft Entra ID (formerly Azure AD).
#### **Overview of What You’ll Do**
1. Create an Enterprise Application in Microsoft Entra ID
2. Configure SAML settings in Microsoft
3. Copy required values into CybaOps
4. Upload certificate and test login
### **Step 1: Create an Enterprise Application**
1. Go to: Microsoft Entra Admin Center
2. Navigate to: \
Applications → Enterprise Applications → New Application
3. Click Create your own application
4. Name it (e.g., CybaOps Platform Admin SSO)
5. Select: \
“Integrate any other application you don’t find in the gallery”
### **Step 2: Configure SAML SSO in Microsoft**
1. Open your new app
2. Go to: Single sign-on
3. Choose: SAML
4. Edit Basic SAML Configuration
5. This can be found in the Setup Single Sign-On drawer under “Issuer Callback URL”. Copy from CybaOps to Entra into “Identifier” and "Reply URL”.
6. Download the Certificate (Base64) file, you will need to copy and paste this into CybaOps.
### **Step 3: Map Microsoft Fields to CybaOps Fields**
Below is where you can find each required field in Microsoft and CybaOps.
1\. Name
* This is created by you as an identifier for the SSO
* Example: CybaOps Platform Admin SSO
2\. Certificate
Enter the information from the certificate downloaded from Entra; it will look something like this:
\-----BEGIN CERTIFICATE----- MIIDXTCCAkWgAwIBAgIJAO3x9k2uQ9zDMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV BAYTAkdCMRMwEQYDVQQIDApxdWFzaS1sYW5kMRMwEQYDVQQKDApFeGFtcGxlIElu YzAeFw0yNDAxMDEwMDAwMDBaFw0yNTAxMDEwMDAwMDBaMEUxCzAJBgNVBAYTAkdC MRMwEQYDVQQIDApxdWFzaS1sYW5kMRMwEQYDVQQKDApFeGFtcGxlIEluYzCCASIw DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALt8z0q3zv5u8x7oJqk9pZJ4uQ0p 3yJ8tq1Y8Y0x9V7o8Qm3pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0l3pY8u8Qm3 pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0l3pY8u8Q m3pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0l3pY8u 8QIDAQABo1AwTjAdBgNVHQ4EFgQUuQ2pQ2x9x0l3pY8u8Qm3pJQb8x0wHwYDVR0j BBgwFoAUuQ2pQ2x9x0l3pY8u8Qm3pJQb8x0wDAYDVR0TBAUwAwEB/zANBgkqhkiG 9w0BAQsFAAOCAQEAj3z0s8k9uQ0p3yJ8tq1Y8Y0x9V7o8Qm3pJQb8x0YV9x0l3pY 8u8Qm3pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0l3 pY8u8Qm3pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0l3pY8u8Qm3pJQb8x0YV9x0 l3pY8u8Q==
\-----END CERTIFICATE-----
3\. Issuer Login URL (IdP Login URL)
This is pre-populated for you – do not amend
You can paste this into the “Sign on URL” section when editing “Basic SAML Configuration”.
4\. Issuer Callback URL (Assertion Consumer Service URL)
This is pre-populated for you – do not amend
This is the URL you will paste into the “Identifier” and “Reply URL” section of **Entra** when editing “Basic SAML Configuration”.
5\. Provider Login URL (Service Provider URL). You will paste this Login URL from **Entra** to **CybaOps**, it is found in section 4 - “Set up ‘Name’”.
It will appear in the format [https://login.microsoftonline.com/\/saml2](https://login.microsoftonline.com/%3ctenant-id%3e/saml2), with the tenant ID automatically populated for your organisation.
7\. Token (Optional / Platform-Specific) - This is pre-populated for you – do not amend
### 🔁 IDP-Initiated Login
IDP = Identity Provider (Microsoft)
There are two login flows:
#### 1. SP-Initiated (Default – Recommended)
* User goes to CybaOps
* Clicks “Login with SSO”
* Redirected to Microsoft
✅ More secure \
✅ Better control \
✅ Standard modern approach
#### 2. IDP-Initiated
* User logs in from Microsoft My Apps portal
* Clicks CybaOps app tile
* Gets logged into CybaOps automatically
🔘 **CybaOps Toggle: IDP-Initiated**
**ON → Enables:**
* Login directly from Microsoft portal
* App tile launch experience
**OFF → Disables:**
* Users must start login from CybaOps
✅ **Final Checklist**
Before going live:
* Check myapps to see if Cybaverse in there
* Certificate uploaded
* Issuer Login URL correct
* Callback URL matches exactly Identifier and Reply URL
* Users assigned in Microsoft
* Test login successful
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cybaops.com/settings/advanced-security-settings-overview/setting-up-single-sign-on-sso.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.