> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/authentication-and-identity/single-sign-on-sso-saml-and-scim.md).

# Single Sign-On (SSO), SAML, and SCIM

Single Sign-On (SSO) lets a user's identity be managed by a single, trusted identity provider that grants access to multiple service providers. It improves security and compliance posture and reduces the number of credentials each user has to manage.

ExaVault supports a service-provider-initiated SAML flow. SAML authenticates an existing ExaVault user for web access. It does not create a user just because the identity provider returns a valid assertion. Create users before their first SSO login, or use SCIM provisioning.

SSO and SCIM perform different jobs. SAML handles web authentication. SCIM creates, updates, disables, and deletes users and manages groups and group membership.

SAML sign-in does not pass through ExaVault's password-login 2FA enrollment flow. Enforce multi-factor authentication in the identity provider for SSO users.

## Configure Microsoft Entra

Add the SmartFile application from the Entra enterprise application gallery. SmartFile is the former name for ExaVault. Follow [Microsoft's SmartFile tutorial](https://learn.microsoft.com/en-us/entra/identity/saas-apps/smartfile-tutorial#add-smartfile-from-the-gallery) for the gallery setup.

Open the application and select *Assign Users and Groups* to choose the Entra users who will sign in to ExaVault.

Select *Setup single sign on*, choose *SAML*, and provide these values in *Basic SAML Configuration*:

* *Identifier (Entity ID)*: your ExaVault site domain without the `https://` prefix.
* *Reply URL (Assertion Consumer Service URL)*: `https://<DOMAIN>/saml2/acs/`.
* *Sign on URL*: `https://<DOMAIN>/ftp/login`.

In *SAML Certificates*, download the *Federation Metadata XML* file for upload to ExaVault.

## Configure ExaVault

Sign into your ExaVault account as an administrator and go to *Admin Settings* by clicking the gear in the upper-right corner.

In the left pane, select *Settings > SSO*. Select *Choose File* for the metadata XML file, choose the file downloaded from Entra, and select *Save*.

For each user assigned to SSO, create or modify the ExaVault user and set *Authentication* to *SSO*. The username value returned by the identity provider must match the ExaVault username mapping configured on the SSO screen.

The site's sign-in page now displays *Single Sign-On*. Users select it to authenticate through Entra to their matching ExaVault account.

If a user gets a page saying that the account does not exist, confirm that the user exists in ExaVault, is enabled and not expired, uses *SSO* authentication, and has a username that matches the SAML Name ID or configured username attribute.

## SAML Lifecycle and Safe Changes

ExaVault reads the identity provider configuration from the uploaded metadata XML file. If the identity provider changes its entity details or signing certificates, upload current metadata before the old configuration stops working.

Keep at least one tested administrator that uses *Internal DB* authentication while configuring or changing SSO. This account provides a recovery path if the identity provider, metadata, or username mapping is unavailable.

Removing the SSO configuration does not convert SSO users to another Authentication method. Before removing SSO, change the affected users to a working method and test the recovery administrator. A change made only in the identity provider also does not disable the local ExaVault account unless SCIM or another provisioning process applies the account change.

## Configure SCIM Provisioning

SCIM provisioning is supported. The current implementation supports user creation and updates, active-state changes, user deletion, group creation and updates, group deletion, and group membership changes.

For Microsoft Entra, follow [Microsoft's SmartFile provisioning tutorial](https://learn.microsoft.com/en-us/entra/identity/saas-apps/smartfile-provisioning-tutorial). The gallery retains the former SmartFile product name. Use `https://<DOMAIN>/ftp/scim` as the tenant URL and the ExaVault provisioning credential requested by the Microsoft setup flow.

Microsoft documents its connector as supporting hard deletes rather than soft deletes. Test provisioning with a small assigned group before expanding it, use the Entra provisioning logs to review failures, and verify delete behavior before applying it to production users. If your offboarding process requires a disable-and-review period, account for that requirement before allowing the connector to delete a user.

## Troubleshoot SSO and SCIM

For SAML, compare the ExaVault hostname, Entity ID, Reply URL, Name ID, and username mapping with the assertion issued by the identity provider. Confirm that assertions are signed. ExaVault requires a signed SAML assertion.

For SCIM, first test the provisioning connection in the identity provider. Then review its provisioning logs for the affected user or group. A successful SSO login does not prove that SCIM provisioning is working, and a provisioned account does not prove that its SAML username mapping is correct.