> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/complete-setup.md). # Invite users to sign in Complete your Single Sign-On (SSO) setup with SCIM or JIT provisioning in SonarQube Cloud and invite users to sign in. After configuring Single Sign-On (SSO), complete your setup by verifying your domain, configuring your recovery account, setting up one-click access, and inviting users to sign in. Domain verification can be done during SSO setup or after it's already configured. After configuring Single Sign-On (SSO), set up one-click access, invite users to sign in, and finalize your SSO setup. {% hint style="warning" %} If you don't use SCIM provisioning, create or verify first the user groups in SonarQube Cloud if not already done. See [Before setting up SSO and provisioning](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/before-you-start.md#managing-groups-in-sonarqube-cloud-if-using-jit-provisioning). {% endhint %} ## Step 1: Configure one-click access SonarQube Cloud uses the Service Provider (SP) initiated SSO (**IdP-initiated SSO is not supported** except through the Okta dashboard if you set up SSO through the Okta Express Configuration). It means that SSO users must go to the login page of SonarQube Cloud. {% hint style="info" %} Make sure to [verify your company's email domain](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/verify-domain.md) to avoid one-time email verification during SSO login. {% endhint %} If you want to use a shortcut link to access the SSO login, use `https://sonarcloud.io/login/sso?enterprise_key=`. You can copy this link directly from SonarQube Cloud as follows: 1. Retrieve your enterprise. See [Retrieving and viewing your enterprise](/sonarqube-cloud/administering-sonarcloud/managing-enterprise/retrieving-and-viewing-your-enterprise.md) for more details. 2. Go to **Administration** > **SSO & Provisioning**. 3. Expand the **Single sign-on** section and select **Copy link** in front of the **Configure one-click access** field. ## Step 2: Invite users to sign in You can now invite users to sign in to SonarQube Cloud with SSO. To do so, send them the login URL of your enterprise. To retrieve the login URL of your enterprise: 1. Retrieve your enterprise. See [Retrieving and viewing your enterprise](/sonarqube-cloud/administering-sonarcloud/managing-enterprise/retrieving-and-viewing-your-enterprise.md) for more details. 2. Go to **Administration** > **SSO & Provisioning**. 3. Expand the **Single sign-on** section and select **Copy link** in front of the **Invite users to sign in** field. You can now paste the copied URL to your invite message.
Select Copy link.
4. Users should check that they have access to their organization(s) in SonarQube Cloud. If they used the DevOps platform service authentication before, they should check that: * They can perform their tasks as before. * If using Personal Access Tokens (PAT): They can generate their analysis tokens with their SSO account. (They can still use their DevOps platform service (DOP) account tokens to execute analysis as long as their DOP account still exists). Note that from the Team plan, it's highly recommended to use Scoped Organization Tokens (SOT) instead of PATs. ## Step 3: Terminate 1. Sign out. Sign in through your enterprise's SSO login link. Check that your SSO account has access to your organization through its group membership. If it does not, check the [group setup](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/before-you-start.md#group-setup-is-mandatory) before you continue. 2. Sign out. Sign in with a DevOps platform (DOP) account that has the **Administer Enterprise** permission. For example, use the account you used to create your enterprise. Give your SSO account the **Administer Enterprise** permission. See [Managing the enterprise-related permissions](/sonarqube-cloud/administering-sonarcloud/managing-enterprise/managing-the-enterprise-related-permissions.md) for more details. 3. Sign out. Sign in with your SSO account and configure your recovery account. See [Recovery account for SSO](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/recovery-account.md) for more details. {% hint style="warning" %} This step is strongly advised for all enterprise administrators. It lets you recover access to your enterprise if SSO login becomes unavailable. {% endhint %} 4. If you transitioned from a DevOps platform authentication service to SSO, you can remove the end users’ DOP accounts from the SonarQube Cloud organizations (see [Adding organization members](/sonarqube-cloud/administering-sonarcloud/managing-organization/users-and-permissions/organization-members.md)). These users can delete their DOP account within SonarQube Cloud (see [Deleting your account](/sonarqube-cloud/managing-your-account/deleting.md)). {% hint style="warning" %} Keep at least one admin or service user account in the DevOps platform. This is very important if you use Bitbucket Cloud, because you cannot link a SonarQube Cloud organization with a Bitbucket Cloud workspace using an SSO account. {% endhint %} ## Related pages * [Before setting up SSO and provisioning](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/before-you-start.md) * [Set up SSO](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/set-up-sso.md) * [Set up SCIM](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/set-up-scim.md) * [Domain verification](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/verify-domain.md) * [Recovery account for SSO](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/recovery-account.md) * [Editing or deleting SSO configuration](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/edit-or-delete-sso-setup.md) * [Troubleshooting SSO and provisioning](/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/troubleshooting.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/enterprise-security/sso-and-provisioning/complete-setup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.