> ## Documentation Index
> Fetch the complete documentation index at: https://docs.adclear.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SSO with Okta

> Connect Okta as your organisation's identity provider so your team signs in to Adclear with their existing Okta accounts.

Single sign-on (SSO) lets your team sign in to Adclear through Okta, using the accounts and access policies you already manage there. Adclear supports Okta through SAML 2.0.

<Note>
  SSO is an organisation-level setting that applies to everyone on your email domain. Setting it up is a joint effort between your Okta administrator and Adclear support.
</Note>

## Before you start

Make sure you have:

* Administrative access to your Okta Admin Console
* Permission to create and configure app integrations in Okta
* The email domain, or domains, your team signs in with (for example `@company.com`)

You'll also need a set of connection values (a sign-on URL and an audience URI) that are unique to your organisation. Contact Adclear support to generate them before you begin. You'll enter them in Okta during setup.

## Set up the app in Okta

<Warning>
  Adclear support provides the **Single sign-on URL** and **Audience URI (SP Entity ID)** in the steps below. Ask our team for these values for your organisation before you start.
</Warning>

<Steps>
  <Step title="Create the app integration">
    In the Okta Admin Console, go to **Applications** and select **Create App Integration**. Choose **SAML 2.0** as the sign-in method, then select **Next**.
  </Step>

  <Step title="Name the application">
    Give the app a name your team will recognise, such as "Adclear" or "Adclear Compliance Platform", then select **Next**.
  </Step>

  <Step title="Enter the SAML settings">
    On the **Configure SAML** screen, enter the values Adclear support gave you:

    * **Single sign-on URL**: the value provided by Adclear
    * **Audience URI (SP Entity ID)**: the value provided by Adclear

    Enable **Use this for Recipient URL and Destination URL**.
  </Step>

  <Step title="Add the attribute statements">
    Under **Attribute Statements**, add the following user attributes so Adclear receives each person's name and email:

    | Name        | Value            |
    | ----------- | ---------------- |
    | `mail`      | `user.email`     |
    | `firstName` | `user.firstName` |
    | `lastName`  | `user.lastName`  |

    <Note>
      If your organisation stores these fields in custom Okta profile attributes, replace the Okta expressions in the **Value** column with your own attribute paths.
    </Note>
  </Step>

  <Step title="Save the application">
    Review the configuration and select **Save**. Okta creates the application and opens its settings.
  </Step>

  <Step title="Copy the IdP metadata URL">
    Open the **Sign On** tab and select **View IdP metadata**. Copy the metadata URL. You'll send this to Adclear support in the next section.
  </Step>

  <Step title="Assign users">
    On the **Assignments** tab, assign the users or groups who should be able to sign in to Adclear. Add any access policies your organisation requires.
  </Step>
</Steps>

## What Adclear needs from you

To finish the connection, send Adclear support:

1. The **IdP metadata URL** you copied from the Sign On tab
2. The **email domain, or domains**, this SSO applies to (for example `@company.com`). Tell us whether to include subdomains such as `@team.company.com`.

## What happens next

Once you've sent those details, Adclear support:

1. Configures the SSO connection on our side
2. Tests it to confirm sign-in works end to end
3. Confirms with you when it's live

Your team can then sign in to Adclear with their Okta credentials.

## Related pages

<CardGroup cols={2}>
  <Card title="How roles work" icon="user-shield" href="/how-roles-work">
    Understand what each role can do once your team signs in.
  </Card>

  <Card title="Settings" icon="gear" href="/settings">
    Manage members, workspaces, and other organisation settings.
  </Card>
</CardGroup>