# SAML (/security/single-sign-on/saml)

Bitelio works as the service provider (SP) with any SAML 2.0 identity provider — Okta, Azure AD/Entra ID, OneLogin, and others.

## Register Bitelio at your IdP

In **Settings → SSO**, choose **SAML** to create the connection. Bitelio shows the **SP details** you register at your IdP:

* **Entity ID**
* **ACS URL** (the assertion consumer service / reply URL)
* **Login URL**
* **Metadata URL**

Most IdPs can import the metadata URL directly and fill in the rest; otherwise copy each value into your IdP's app configuration by hand.

## Add your IdP's details

Back in Bitelio, paste what your IdP gives you for this app:

* **Entity ID**
* **SSO URL**
* **X.509 signing certificate**

Bitelio requires signed assertions — an unsigned or invalid signature is rejected, so make sure signing is turned on for this app in your IdP before testing.

## Finish setup

Set the connection's **default role** — this is what a member gets on their first SSO login — then enable the connection. Test it by opening the login URL from the SSO settings page; a successful sign-in confirms the certificate and URLs are wired up correctly.

## What's next

<Cards>
  <Card title="OIDC" href="/security/single-sign-on/oidc">
    The alternative protocol, if your IdP prefers OpenID Connect.
  </Card>

  <Card title="Single sign-on" href="/security/single-sign-on">
    Domain verification, JIT provisioning, and how sign-in is initiated.
  </Card>
</Cards>