> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gavai.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO — Microsoft Entra ID

> Configure SAML SSO between Microsoft Entra ID (formerly Azure AD) and gavAI

This page walks the Entra ID-side setup. The gavAI-side counterpart is the wizard at `/console/settings/sso/new/entra`.

## Prerequisites

* Entra ID admin (Global Administrator or Application Administrator).
* Workspace admin in gavAI on a Scale or Enterprise plan.
* One or more email domains you control.

## 1. Create the Enterprise Application

1. Entra Admin Center → **Enterprise applications → New application → Create your own application**.
2. Name it `gavAI` (or `gavAI — <workspace name>`). Pick **Integrate any other application you don't find in the gallery (Non-gallery)**.
3. Once created, go to **Single sign-on → SAML**.

## 2. Configure SAML

Edit the **Basic SAML Configuration**:

* **Identifier (Entity ID)**: copy from the gavAI wizard.
* **Reply URL (Assertion Consumer Service URL)**: copy from the gavAI wizard.
* **Sign on URL**: optional.

Under **Attributes & Claims**, ensure:

* `Unique User Identifier (Name ID)` → `user.mail` (Email).
* Optional: `givenname` → `user.givenname`, `surname` → `user.surname`.

## 3. Assign users / groups

**Users and groups → Add user/group**. Group-based assignment is preferred.

## 4. Hand metadata back to gavAI

In the SAML page, copy the **App Federation Metadata URL** (under SAML Certificates) and paste it into `/console/settings/sso/new/entra`.

## 5. Verify domains and test

Add the TXT record gavAI shows, wait for verification, then sign in at `https://gavai.io/login` with an Entra-managed account.

## Optional: SCIM provisioning

Pair SSO with [SCIM](/integrations/scim) for automated user lifecycle.