> ## Documentation Index
> Fetch the complete documentation index at: https://greatquestion.co/support/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML Integration via Azure AD

> Configure SAML single sign-on for Great Question using Microsoft Entra ID (Azure AD).

SAML single sign-on lets your team sign in to Great Question with your existing Microsoft Entra ID (Azure AD) credentials. This guide walks through creating the enterprise application in Azure AD and connecting it to Great Question.

<Note>
  SAML authentication is available on **Enterprise** plans only. Each Great Question account supports a single SAML provider at a time, if you need Okta instead, see the [Okta SAML guide](/support/support/integrations/saml-integration-okta); setting one up replaces the other.
</Note>

## Step 1: Create the enterprise application in Azure AD

1. In Azure AD, create a new **enterprise application** and set up **Single Sign-On with SAML**.
2. Configure the following identifiers:

| Field                  | Value                                          |
| ---------------------- | ---------------------------------------------- |
| Identifier (Entity ID) | `https://greatquestion.co/users/saml/metadata` |
| Reply URL (ACS URL)    | `https://greatquestion.co/users/saml/auth`     |

3. From the Azure AD SAML configuration, gather these three items:
   * The **Base64 certificate** (download it)
   * The **Azure AD Identifier**
   * The **Login URL**

## Step 2: Connect Azure AD in Great Question

1. In Great Question, go to **Settings > Governance > [Security](https://greatquestion.co/governance/security)**.
2. Under **Authentication methods**, enable **SAML**.
3. Click **Setup** next to SAML configuration and enter the values you gathered from Azure AD:

| Great Question field | Azure AD value                |
| -------------------- | ----------------------------- |
| IDP SSO target URL   | Login URL                     |
| IDP Entity           | Azure AD Identifier           |
| IDP Certificate      | Downloaded Base64 certificate |

<Warning>
  Paste the certificate exactly as downloaded, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines and all line breaks. Extra whitespace or missing header lines are the most common cause of a failed connection.
</Warning>

## Signing in

Once SAML is configured, any user with access to Great Question in your Azure AD can sign in directly from their Azure AD profile. A first-time sign-in with no pending invite defaults to a free **Observer** account.

Existing Great Question users can connect their Azure AD login by going to [greatquestion.co/sso](https://greatquestion.co/sso) and entering their work email.

***

**Still need help?** Contact us at [support@greatquestion.co](mailto:support@greatquestion.co) — median response time is 19 minutes during [support hours](https://greatquestion.co/features/about-our-support-team).