> For the complete documentation index, see [llms.txt](https://docs.verygoodsecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.verygoodsecurity.com/enterprise-platform/access-management/enterprise-identity-providers/saml-2.0-configuration.md).

# SAML 2.0 Configuration

> You need to [**activate**](/enterprise-platform/access-management/manage-organizations.md#activating-an-organization) your organization before you proceed with custom IDP SSO setup.

## SAML identity provider

When you will visit **Organization Settings** page on [Dashboard](https://docs.verygoodsecurity.com/card-management) you will find main VGS service provider details, needed for SAML identity providers configurations like *Okta*, Google etc

* **ACS URL** - VGS service provider endpoint (URL) that is responsible for receiving and parsing a SAML assertion. Keep in mind that some identity providers use a different term for the ACS.
* **ENTITY ID** - a globally unique name for VGS Service Provider (SP).
* **LOGIN URL** - you will use this url to login to Dashboard with your identity provider.
* **METADATA URL** - a set of information supplied by the IdP to our SP, and/or vice versa, in xml format. This needs to be provided to VGS.

<figure><img src="https://1773866054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzbOVGj5YTirkppRKlOP9%2Fuploads%2FYSDBVT3v3CAUYvnhyrBt%2FScreenshot%202026-10-07%20at%202.25.14%E2%80%AFPM.png?alt=media&amp;token=bb71d1ca-24a0-4b38-b7ae-384dc16d7821" alt=""><figcaption></figcaption></figure>

> If your identity provider does not provide **METADATA URL**, you should contact our support [support@vgs.io](mailto:support@verygoodsecurity.com) and provide your IDP configuration details.

## Integration

You can configure any identity provider that support SAML 2.0. Also you can use one of the manuals listed below:

* [Okta](/enterprise-platform/access-management/enterprise-identity-providers/okta.md)
* [Google Workspace](/enterprise-platform/access-management/enterprise-identity-providers/google-workspace.md)
* [Azure Active Directory](/enterprise-platform/access-management/enterprise-identity-providers/azure-active-directory.md)

When you configured your IDP, you need to copy and paste **METADATA URL** and press `Save`. After that, you need to enable **SAML SSO** login with toggle to start using it.&#x20;

> After you've enabled **SAML SSO Login** you will be able to login to Dashboard via **LOGIN URL**.

## Verify SSO

1. Open the **LOGIN URL** that you copy on **Organization Settings**. It should automatically redirect you to the IDP sign-in page.
2. Enter your username and password. After a successful authentication, you will be redirected back to VGS Dashboard.

## Restricting access to SSO-only logins

Only users logging in with your configured IDP will be able to access your organization. Users logging in with username/password, or with a different IDP, will be prevented access to your organization.

To enable **SSO-only** login you need to follow these simple steps:

* Login with your IDP via **LOGIN URL**.
* Enable `Require organization members to sign in using SAML SSO` toggle on **Organization Settings** page.&#x20;
* Now access to your organization is restricted to only those users that have logged in using your IDP via **LOGIN URL**.

> You may want to use this feature to be sure that removed users from your IDP can not see Organization details anymore.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.verygoodsecurity.com/enterprise-platform/access-management/enterprise-identity-providers/saml-2.0-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.