# SAML authentication Integrating with your organization's identity provider (IdP) with Temporal Cloud through Security Assertion Markup Language (SAML) 2.0 allows you to authenticate users of your Temporal Cloud account using your organization's IdP. This allows you to enforce your corporate identity policies, such as multi-factor authentication (MFA), password complexity, and reduces the risk of credential theft. SAML is included in the Business, Enterprise, and Mission Critical plans. For more details, refer to [Temporal Cloud pricing](/cloud/pricing#base_plans). ## Integrate SAML with your Temporal Cloud account 1. Locate your [Temporal Cloud Account Id](/cloud/namespaces#temporal-cloud-account-id). Your Account Id can be viewed and copied from the Temporal Cloud user profile dropdown menu in the top right corner. Alternatively, find your [Namespace Id](/cloud/namespaces#temporal-cloud-namespace-id). The Account Id is the five or six characters following the period (.), such as `f45a2`. You will need the Account Id to construct your callback URL and your entity identifier. 1. Configure SAML with your IdP by following one of these sets of instructions: - [Microsoft Entra ID](#configure-saml-with-azure-ad) - [Okta](#configure-saml-with-okta) 1. [Share your connection information with us and test your connection.](#finish-saml-configuration) ## How to configure SAML with Microsoft Entra ID If you want to use the general Microsoft login mechanism, you don't need to set up SAML with Entra ID. Just select **Continue with Microsoft** on the Temporal Cloud sign-in page. To use Entra ID as your SAML IdP, create a Microsoft Entra ID Enterprise application. 1. Sign in to the [Microsoft Entra ID](https://portal.azure.com/). 1. On the home page, under **Manage Microsoft Entra ID**, select **View**. 1. On the **Overview** page near the top, select **Add > Enterprise application**. 1. On the **Browse Microsoft Entra ID Gallery** page near the top, select **Create your own application**. 1. In the **Create your own application** pane, provide a name for your application (such as `temporal-cloud`) and select **Integrate any other application you don't find in the gallery**. 1. Select **Save**. 1. In the **Getting Started** section, select **2. Set up single sign on**. 1. On the **Single sign-on** page, select **SAML**. 1. In the **Basic SAML Configuration** section of the **SAML-based Sign-on** page, select **Edit**. 1. In **Identifier (Entity ID)**, enter the following entity identifier, including your Account Id where indicated: ```bash urn:auth0:prod-tmprl:ACCOUNT_ID-saml ``` A correctly formed entity identifier looks like this: ```bash urn:auth0:prod-tmprl:f45a2-saml ``` 1. In **Reply URL (Assertion Consumer Service URL)**, enter the following callback URL, including your Account Id where indicated: ```bash https://login.tmprl.cloud/login/callback?connection=ACCOUNT_ID-saml ``` A correctly formed callback URL looks like this: ```bash https://login.tmprl.cloud/login/callback?connection=f45a2-saml ``` 1. In **Sign on URL**, enter the following login url, including your Account Id where indicated: ```bash https://cloud.temporal.io/login/saml?connection=ACCOUNT_ID-saml ``` A correctly formed login URL looks like this: ```bash https://cloud.temporal.io/login/saml?connection=f45a2-saml ``` 1. You can leave the other fields blank. Near the top of the pane, select **Save**. 1. In the **Attributes & Claims** section, select **Edit**. Configure the following settings. Under **Required claim**: - Set **Unique User Identifier (NameID)** to `user.userprincipalname` - Set the **NameID format** to `emailAddress` These are the default settings for Microsoft Entra ID. Then under **Additional claims**, ensure **Email** and **Name** are present. 1. Collect information that you need to send to us: - In the **SAML Certificates** section of the **SAML-based Sign-on** page, select the download link for **Certificate (Base64)**. - In the **Set up _APPLICATION_NAME_** section of the **SAML-based Sign-on** page, copy the value of **Login URL**. To finish setting up Microsoft Entra ID as your SAML IdP, see [Finish SAML configuration](#finish-saml-configuration). ## How to configure SAML with Okta To use Okta as your SAML IdP, configure a new Okta application integration. 1. Sign in to the [Okta Admin Console](https://www.okta.com/login/). 1. In the left navigation pane, select **Applications > Applications**. 1. On the **Applications** page, select **Create App Integration**. 1. In the **Create a new app integration** dialog, select **SAML 2.0** and then select **Next**. 1. On the **Create SAML Integration** page in the **General Settings** section, provide a name for your application (such as `temporal-cloud`) and then select **Next**. 1. In the **Configure SAML** section in **Single sign on URL**, enter the following callback URL, including your Account Id where indicated: ```bash https://login.tmprl.cloud/login/callback?connection=ACCOUNT_ID-saml ``` A correctly formed callback URL looks like this: ```bash https://login.tmprl.cloud/login/callback?connection=f45a2-saml ``` 1. In **Audience URI (SP Entity ID)**, enter the following entity identifier, including your Account Id where indicated: ```bash urn:auth0:prod-tmprl:ACCOUNT_ID-saml ``` A correctly formed entity identifier looks like this: ```bash urn:auth0:prod-tmprl:f45a2-saml ``` 1. We require the user's full email address when connecting to Temporal. - In **Name ID format**, select `EmailAddress`. - In **Attribute Statements**, set **email** and **name**. 1. Select **Next**. 1. In the **Feedback** section, select **Finish**. 1. On the **Applications** page, select the name of the application integration you just created. 1. On the application integration page, select the **Sign On** tab. 1. Under **SAML Setup**, select **View SAML setup instructions**. 1. Collect information that you need to send to us: - Copy the IdP settings. - Download the active certificate. To finish setting up Okta as your SAML IdP, see the next section, [Finish SAML configuration](#finish-saml-configuration). ## How to finish your SAML configuration After you configure SAML with your IdP, we can finish the configuration on our side. [Create a support ticket](/cloud/support#support-ticket) that includes the following information: - The sign-in URL from your application - The X.509 SAML sign-in certificate in PEM format - One or more IdP domains to map to the SAML connection Generally, the provided IdP domain is the same as the domain for your email address. You can provide multiple IdP domains. When you receive confirmation from us that we have finished configuration, log in to Temporal Cloud. This time, though, enter your email address and click **Continue**. You will be directed to the authentication page of your IdP.