> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/before-you-start.md).
# Before setting up SSO and provisioning
We recommend that you read [About SSO and provisioning](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/about.md) before starting the setup.
## SSO and provisioning setup overview
The setup steps are as follows:
1. **Set up SSO**\
SonarQube Cloud provides a setup assistant to help you configure custom SAML or Okta OIDC. See [Set up SSO](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/set-up-sso.md).\
If you hold administrative rights for both your Okta tenant and SonarQube Cloud enterprise, you can alternatively use the Okta Express Configuration to set up SSO. See [Using Okta Express Configuration](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/using-okta-express-configuration.md).
2. **Set up SCIM**\
This step is optional. You can perform it directly after setting up SSO or anytime later. See [Set up SCIM](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/set-up-scim.md).\
If you don't set up SCIM provisioning, Just-in-Time provisioning will apply. In this case, you have to create first the groups in SonarQube Cloud manually or verify your existing groups. See [#managing-groups-in-sonarqube-cloud-if-using-jit-provisioning](#managing-groups-in-sonarqube-cloud-if-using-jit-provisioning "mention").
3. **Invite users to sign in**\
In this step, you will configure one-click access, invite your users to sign in via SSO, and finalize your SSO setup.\
See [Invite users to sign in](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/complete-setup.md).
## Important notes
### Service Provider (SP) initiated SSO
SonarQube Cloud uses Service Provider (SP) initiated Single Sign-On (SSO). This process involves users attempting to log in to SonarQube Cloud, which then redirects them to your identity provider for authentication.
Identity Provider (IdP) initiated SSO is supported only through the Okta dashboard if you set up SSO with the Okta Express Configuration or by using the one-click access link in the SSO & Provisioning screen.
### Group setup is mandatory
Be aware that with SSO, groups are mandatory. Users have access to their SonarQube Cloud organization only if they are members of a group within this organization.
It means that you must assign groups to the SonarQube Cloud application that you will create in your identity provider:
* If you intend to use [SCIM provisioning](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/about.md#scim), you'll map groups to organizations during the SCIM setup, and groups will be automatically created in the relevant SonarQube Cloud organizations.
* Otherwise, Just-in-Time provisioning with [automatic group synchronization](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/about.md#auto-group-sync) will apply. In that case, *you must create the user groups manually in your SonarQube Cloud organizations* as described below in [#managing-groups-in-sonarqube-cloud-if-using-jit-provisioning](#managing-groups-in-sonarqube-cloud-if-using-jit-provisioning "mention").
Regardless of your chosen provisioning method, you must configure the groups attribute in the SAML or OIDC payload. If you use SCIM provisioning, ensuring this value aligns with the data SCIM transmits to SonarQube Cloud is essential.
## Managing groups in SonarQube Cloud if using JIT provisioning
If you don't use SCIM provisioning with SSO, [Just-in-Time provisioning](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/about.md#just-in-time) will apply. In that case, you must create the user groups also in SonarQube Cloud and ensure the automatic group synchronization can take place properly. To do so, make sure that:
* The user groups defined in your IdP service exist in the relevant organizations of your SonarQube Cloud enterprise (i.e. a group with the same (context-sensitive) name exists in the relevant organization(s)).
* The user groups in SonarQube Cloud have the correct permissions.
{% hint style="warning" %}
JIT SSO users' group memberships are reset to match those in your identity provider upon login. If you add a JIT SSO user to a SonarQube Cloud group that doesn't exist in the identity provider, the user will be removed from that group on their next login.
{% endhint %}
To manage the user groups in SonarQube Cloud, see [Managing user groups](/sonarqube-cloud/administering-sonarcloud/managing-organization/users-and-permissions/user-groups.md).
### Verify groups
#### With Okta
The automatic group synchronization of a group applies if the group in Okta and the corresponding group in the SonarQube Cloud organization have the same (case-sensitive) name. Note that the default SonarQube Cloud’s Members group is excluded from the synchronization.
The figure below shows on the left groups defined in Okta and on the right the corresponding groups defined in SonarQube Cloud in two different organizations (`OrgA` and `OrgB`). In this example, the SSO users belonging to `ENT_ORGA_ADMINS` will be automatically added to the corresponding `EN_ORG_ADMINS` group in SonarQube Cloud. it means that they will have access to `OrgA` with the permissions defined in SonarQube Cloud.
#### With Microsoft Entra ID
The automatic group synchronization of a group applies if the group in Microsoft Entra ID and the corresponding group in the SonarQube Cloud organization have the same (case-sensitive) name. Note that the default SonarQube Cloud’s Members group is excluded from the synchronization.
The figure below shows on the left groups defined in Microsoft Entra ID and on the right the corresponding groups defined in SonarQube Cloud in two different organizations (`Docs-Team` and `claudiasonarova 2023`). In this example, the SSO users belonging to `Communications` will be automatically added to the corresponding `Communications` group in SonarQube Cloud. it means that they will have access to the `Docs-Team` organization with the permissions defined in SonarQube Cloud.
{% hint style="warning" %}
* Group synchronization doesn’t work with Microsoft Entra ID’s nested groups.
* Microsoft Entra ID’s SAML tokens have a limit regarding the number of groups a user can belong to (see the description of groups in the [Claims in SAML Token](https://learn.microsoft.com/en-us/entra/identity-platform/reference-saml-tokens#claims-in-saml-tokens) table). In such cases, you might need to reduce the number of groups the user is in.
{% endhint %}
### Verify group permissions
To verify the group permissions at the enterprise level, see [Managing the enterprise-related permissions](/sonarqube-cloud/administering-sonarcloud/managing-enterprise/managing-the-enterprise-related-permissions.md).
In an organization, you can:
* Verify the groups that can create projects in the organization. See [Managing organization permissions](/sonarqube-cloud/administering-sonarcloud/managing-organization/users-and-permissions/organization-permissions.md) for more details.
* Verify the default permissions on new projects. See [Using permission templates](/sonarqube-cloud/administering-sonarcloud/managing-organization/manage-org-projects/manage-project-permissions/templates.md) for more details.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/before-you-start.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.