> ## Documentation Index > Fetch the complete documentation index at: https://support.i.moneyforward.com/llms.txt > Use this file to discover all available pages before exploring further. # How to Configure SAML > Configure SAML integration for single sign-on. ### Retrieve your organization's SAML settings Go to **Settings > Security** and locate the SAML section. Copy and save the **SAML entity ID** and **SAML reply URL**. You will enter these values in your IdP's SSO configuration screen. SAML settings screen #### Retrieve SAML metadata from your Identity Provider You first need to create an SSO app. The steps vary depending on your **Identity Provider (IdP)**. #### Microsoft Entra ID (Azure AD) 1. Select Enterprise Applications. Select Enterprise Application 2. Click **New Application**. New Application 3. Enter a name for your application (for example: `service name`). Set app name 4. Click **Create** and wait a moment. When the app screen appears, select **Single sign-on > SAML**. Select SAML 5. Enter the following values. | Field | Value | | -------------------------- | ----------------------------------------------------- | | **Identifier (Entity ID)** | The `SAML entity ID` shown on our SSO settings screen | | **Reply URL** | The `SAML reply URL` shown on our SSO settings screen | | **Unique User ID** | Change from `user.principalname` to `user.mail` | Enter settings 6. After saving, copy the **App Federation Metadata URL**. Paste the copied URL into the `SAML metadata URL` field and save. Azure AD SAML configuration is now complete. Next, [enable SAML](/en/it-management/settings/sni7chcawy-saml#enable-saml). #### Google Workspace 1. Sign in to the GWS Admin Console and go to **Apps > Web and mobile apps**. Select **Add Custom SAML App** from the Add app menu. Add Custom SAML App 2. Enter an application name and click **CONTINUE**. Set app name 3. Click **DOWNLOAD METADATA** and save the metadata file. Download metadata 4. Enter the values you copied into **ACS URL** and **Entity ID**, then click **Continue**. Enter ACS URL and Entity ID 5. On the next screen, click **FINISH** without entering anything. Your SAML application is now created. Complete #### Okta Okta Integration Network (OIN) is now supported, making setup much easier. Follow the steps at the link below: [SAML/SCIM setup with Okta Integration Network](/en/it-management/settings/wllb3ml0pq-oin) 1. Go to the Okta Admin Console and click the button to add an application. Add application 2. Click the button to create a new application. Create new application 3. Set **Platform** to `Web`, select `SAML 2.0` as the **Sign on method**, and click **Create**. Select SAML 2.0 4. Enter an application name (for example: `service name`) and proceed to the next screen. Enter app name 5. Enter the SAML settings and proceed to the next screen. **Single sign on URL**: enter the `SAML reply URL` shown earlier. **Audience URI**: enter the `SAML entity ID` shown earlier. **Name ID format**: select `EmailAddress`. Enter SAML settings 6. On the next screen, click the **`Identity Provider metadata`** link. Identity Provider metadata 7. The XML file opens in a new tab. Copy that URL and enter it into the `SAML metadata URL` field. Enter SAML metadata URL 8. Okta SAML configuration is now complete. Next, [enable SAML](/en/it-management/settings/sni7chcawy-saml#enable-saml). #### OneLogin 1. In the OneLogin Admin Console, click the button to add an app. Add app 2. Search for `SCIM` and select **SCIM Provisioner with SAML (SCIM v2 Core)**. Select SCIM Provisioner 3. Enter an application name and save (for example: `company name`). Save app name 4. Open the **Configuration** tab, enter the following values, and save. **SAML Audience URL**: enter the `SAML entity ID` value. **SAML Consumer URL**: enter the `SAML reply URL` value. **SCIM Base URL**: enter a placeholder URL for now — you will configure this later on the SCIM settings page. Configuration settings 5. Select the **SSO** tab and copy the **Issuer URL**. Paste it into the `SAML metadata URL` field and save. SSO settings 6. OneLogin SAML configuration is now complete. Next, [enable SAML](/en/it-management/settings/sni7chcawy-saml#enable-saml). #### HENNGE One For SAML integration with HENNGE One, contact the HENNGE support center. After completing the setup, follow the steps below to enable SAML.

Enable SAML

Set the SAML metadata URL you obtained in the previous step. 1. For Google Workspace, select a file and upload the metadata file. The screenshots below show how to configure using a URL. Set SAML metadata URL Set SAML metadata URL 2 2. Turn on the SAML enable switch. Enable SAML Enable SAML 2 3. SAML-based SSO setup is now complete. Assign users in each SaaS application and verify that single sign-on works. Next, configure SCIM for user provisioning. [How to Configure SCIM](/en/it-management/settings/msu9u84kyh-scim) #### Update SAML settings Go to **Settings > Security** and locate the SAML section. Before your SAML certificate expires, issue a new certificate in your IdP and update the SAML metadata URL. 1. Click **Edit** next to SAML metadata. Edit SAML 2. Before changing the SAML metadata URL, note down the current URL as a backup. Enter the new SAML metadata URL and click **Save**. Change SAML metadata URL #### For Admin users Users with the Admin role follow a slightly different login flow. This prevents Admin users from being locked out if the SAML configuration fails. We also recommend [requiring multi-factor authentication (MFA) at sign-in](/en/it-management/settings/lqb4m5d1tj-login-method-2fa). For users with the Admin role: 1. When signing in from the login screen, the user logs in directly using their MoneyForward ID. The IdP does not receive a redirect. 2. When signing in from the IdP login UI, the IdP Initiated Flow (sign in via SSO) is used. Admin login flow #### FAQ #### Q. I am an Admin, but I cannot sign in with my MoneyForward ID on the login screen. What should I check if the password reset email does not arrive? A. If you do not have a MoneyForward ID, you need to create one. See [**If you do not have a MoneyForward ID**](/en/it-management/tutorial/93a9bikaqq-user#no-moneyforward-id) for details. If the email does not arrive, see [If you cannot receive emails](https://biz.moneyforward.com/support/guide/a010.html#wrapper). #### Q. After configuring SAML, how do I sign in with the Admin role? A. The login method depends on where you initiate the sign-in. To prevent lockout if the SAML configuration fails, the following behavior applies. **Signing in from the login screen**: You log in directly using your MoneyForward ID. **Signing in from the IdP login UI**: The IdP Initiated Flow (sign in via SSO) is used.