# Set up SSO with SAML (/docs/support/security/single-sign-on/set-up-sso-with-saml)

Circleback works with any identity provider that supports SAML 2.0, so your team can sign in with the provider your company already uses.

If you use [Google Workspace](/docs/support/security/single-sign-on/set-up-sso-with-google-workspace), [Microsoft Entra ID](/docs/support/security/single-sign-on/set-up-sso-with-microsoft-entra-id), or [Okta](/docs/support/security/single-sign-on/set-up-sso-with-okta), follow the guide for that provider. For any other SAML provider, use the steps below.

You need to be a Circleback workspace admin and have access to manage applications in your identity provider. See [Set up single sign-on](/docs/support/security/single-sign-on/sso) for workspace requirements.

## Create a SAML application

1. In Circleback, go to Settings → General (under Workspace).
2. Under **Single sign-on**, select **Connect**. Choose **SAML**, then select **Continue**. Keep this form open.
3. In another tab, open your provider's admin console and create a SAML 2.0 application named **Circleback**.
4. Copy the **ACS URL** and **Entity ID** from Circleback into your provider's application settings, and set the Name ID to the member's Circleback email address.

Field names may vary by provider:

| Field                                                      | Value                                      |
| ---------------------------------------------------------- | ------------------------------------------ |
| ACS URL, Single sign-on URL, Reply URL, or Destination URL | `https://circleback.ai/api/sso/oauth/saml` |
| Entity ID, Identifier, or Audience URI                     | `https://circleback.ai/api/sso/metadata`   |
| Name ID                                                    | The member's Circleback email address      |
| Name ID format                                             | Email address                              |

Configure the application to sign SAML responses and assertions using RSA-SHA256, and leave assertion encryption off.

## Map user attributes

Add these attributes so Circleback receives each person's email and name:

| SAML attribute | Value from your directory             |
| -------------- | ------------------------------------- |
| `email`        | The member's Circleback email address |
| `firstName`    | First name                            |
| `lastName`     | Last name                             |

Circleback also accepts the standard claim names ending in `emailaddress`, `givenname`, and `surname` under `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/`.

Save your changes and give the people or groups who should use Circleback access to the application.

Copy your provider's SAML metadata URL or download its metadata XML file. In the open Circleback form, under **Metadata source**, choose **Metadata URL**, **Upload XML file**, or **Paste XML manually**, then add your metadata. A metadata URL must use HTTPS.

Select **Continue**. Leave **No directory sync** selected if you only need SSO, or choose a directory provider to set up SCIM provisioning. Select **Connect**.

If you chose a directory provider, use the credentials shown in Circleback to [set up directory sync](/docs/support/security/single-sign-on/sso).

To require everyone in your workspace to log in with SSO, follow [Enforce SSO for your workspace](/docs/support/security/single-sign-on/sso).