> For the complete documentation index, see [llms.txt](https://help.tillit.cloud/tillit/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.tillit.cloud/tillit/knowledge-base/users/user-authentication.md).

# User authentication with SSO

## SSO.

Many organisations may often have existing employee accounts for other services, such as Microsoft and Google.

If that is the case, TilliT can utilise them to manage TilliT users.

Commonly known as Single Sign-On (SSO), you can connect to TilliT with any service using the SAML standard.

SAML is supported by many providers including **Microsoft**, **Amazon (AWS)**, **Google** and many others.

We recommend discussing this with a member of the TilliT Support team.

Contact us to discuss using SSO.

## Azure Active Directory (Microsoft)

This guide will cover setting up TilliT with Azure Active Directory. Each tenant can now set up Single Sign-On (SSO) directly from Account Settings, allowing secure and streamlined access to the platform through your identity provider.

Click on your avatar on the top-right, choose **Account**. You will be presented with the Account page interface below. Click on **SSO** setup and **start the SSO Setup**.

You will need the provided Entity ID and Reply URL to set this up in Azure.

<figure><img src="/files/KxKx9i5OHE5KZclpDftS" alt="SSO Setup screen in TilliT showing Step 1 with Identity Entity ID and Reply URL fields."><figcaption></figcaption></figure>

Open Azure Portal <https://portal.azure.com/>, on the right side menu choose “Azure Active Directory”.

<figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/60208fd212248b2c96d50eeb/images/612f167f00c03d6720752d84/file-4jQgkDTMz5.png" alt="Azure Active Directory dashboard showing the default directory overview page with Enterprise applications highlighted in the navigation sidebar."><figcaption></figcaption></figure>

Start the process of creating a new Enterprise application. Select "non-gallery application". Give it a name (TilliT?).

Inside the newly created application, head to Single sign-on and pick SAML.

In the Identifier (Entity ID) and Reply URL, enter the data you've received from the Account page.

Save your changes, it should look like this:

<figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/60208fd212248b2c96d50eeb/images/612f16282b380503dfdecf41/file-CP8yqG9sRJ.png" alt="Azure SAML-based Sign-on configuration page displaying Basic SAML Configuration, User Attributes &#x26; Claims, and SAML Signing Certificate sections."><figcaption></figcaption></figure>

Finally, copy the App Federation Metadata URL and paste that into the second step of the setup form in TilliT DO.

<figure><img src="/files/yy4CfqQPzuxfX2iSRt9v" alt="SSO Setup screen in TilliT showing Step 2 with an input field to enter the SAML Metadata URL."><figcaption></figcaption></figure>

In the next steps, the attributes are mapped with some defaults but feel free to edit them.

<figure><img src="/files/wkfy6sbZk1yQTyHWKExL" alt="SSO Setup screen in TilliT showing Step 3 for mapping SAML provider attributes such as email, family_name, and first name."><figcaption></figcaption></figure>

Finally choose your additional configurations, it is crucial to have the provider enabled

<figure><img src="/files/pPIKiAMXIm8vVsNNsiRJ" alt=""><figcaption></figcaption></figure>

After creation your SSO Setup page will be populated with values like this.

<figure><img src="/files/DhSpDRhBfVydTxqjjQL2" alt="TilliT Your Identity Provider Details page displaying SAML Provider Type, Metadata URL, configured Attribute Mappings, Provider Options set to Enable, and Update Information and Delete buttons."><figcaption></figcaption></figure>

### Just In Time Provisioning

You can model your TilliT Groups and TilliT Roles in your Identity Provider and send them as Group claims in your SAML configuration.

{% hint style="warning" %}
**This will take precedence over any role & group assignment performed within TilliT. This means user role and group assignment is now handled by IT or those who manage your IDP.**
{% endhint %}

**Example:**

Here we have added the groups claim in to our Enterprise Application in Azure. We have modelled our Azure Groups using the “tillit-” prefix and only send those in the SAML claims.

1. Model your groups within your IDP, ensure you have created all [groups](/tillit/knowledge-base/users/groups.md) and [roles](/tillit/knowledge-base/users/permissions.md).

<figure><img src="/files/C3iIsk6RtBnwpVKa3b64" alt="Azure AD groups table listing tillit-prefixed security groups and their Object IDs."><figcaption></figcaption></figure>

2. Add the groups claim to the SSO configuration for your Enterprise Application

<figure><img src="/files/yywEV63gHtuJkMPrwBt0" alt="Azure SAML additional claims table showing a user.groups claim entry."><figcaption></figcaption></figure>

<figure><img src="/files/q4Oye2d8G4NtDkMwMfqI" alt="Microsoft Entra ID Groups Claims settings filtering security groups by the prefix tillit-."><figcaption></figcaption></figure>

3. Contact support and send through the Group Ids like shown in step 1 for all the TilliT groups.