> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.
# Single Sign-On (SSO) Overview
> Use SSO to manage logins centrally through your identity provider and connect features like attribute mapping to internal booking logic.
With SSO, you connect anny to your organization's identity system, so users can sign in with their existing company login. This simplifies logging in, reduces manual user management, and creates a shared foundation for further features like attribute mapping. This article is aimed at admins and IT managers who want to decide which SSO building blocks they need in anny and how they fit together.
## Who is this feature for?
SSO in anny is especially useful for organizations that want to manage access centrally and cleanly connect internal booking areas with existing user accounts.
## Where do you find the feature in anny?
You find the SSO-related settings in your account settings under [**SSO & Security**](https://app.anny.co/organization/settings/sso?o=).
* Open the account settings of your anny account.
* Switch to the SSO & Security area.
* There you find the configuration for SSO as well as adjacent areas like SCIM and attribute mapping.
* In the same context, you can also create mapping rules.
**Important**: Attribute mapping requires SSO to be set up and active. Without an active SSO connection, the required attributes are usually not reliably available.
## How the logic works
* In anny, SSO handles authentication. Users sign in with an external identity provider such as Microsoft 365, Google Workspace, or another SAML 2 system.
* SCIM is separate from this. SCIM handles the automatic provisioning and synchronization of user accounts in the background and is not the same as the actual login.
* Attribute mapping uses the attributes or groups passed by the identity provider to assign users to specific communities in anny.
## Overview: The elements involved
| Element | Description |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **Identity Provider (IdP)** | The external system that centrally manages your users' identities (e.g. Microsoft Entra ID, Google Workspace, Okta). |
| **SAML 2.0** | The standard protocol anny uses to perform the secure login (single sign-on) between your IdP and anny. |
| **OAuth2** | An alternative protocol for secure login and authorization. **Note:** OAuth2 can currently only be set up for you by anny Support. |
| **SCIM (User Provisioning)** | A separate background process (backchannel) that automatically creates, updates, or deactivates users in anny without them having to log in. |
| **Attribute Mapping** | The translation rule that defines which data from the IdP (e.g. name, department) is written into which fields in anny. |
## Setting up the SSO protocols in anny
**The SSO setup (SAML 2.0)**
* [Set up Microsoft 365 (SAML 2)](/en/microsoft-saml-sso)
* [Set up Google Workspace (SAML 2)](/en/google-workspace-sso)
* Set up generic SAML 2.0 (Okta, Auth0, etc.)
* Use federated SAML 2.0 in anny
* [Set up SCIM](/en/scim-user-provisioning) (including in Microsoft Entra)
## Attribute mapping
With [attribute mapping](/en/attribute-mapping), you can assign user properties from your IdP (user management) to anny communities. This way, members can automatically be added (auto-join) to their respective internal booking areas (communities).
Learn more [here](/en/attribute-mapping).
## Troubleshooting SSO
If you see this error, check whether the identity provider has been activated. Activate the identity provider via the three dots > Activate.
This error occurs when users must be explicitly added to the application in Microsoft and have not yet been added. There are two ways to fix this problem:
**1. Do not require user assignment**
To do this, go to the application in Microsoft Azure and then to Properties. Set the "Assignment required" option to "No".
**2. Assign users to the application**
You can add the users who are allowed to log in through it to the application. To do this, go to your application in Microsoft Azure and then to Users and groups. Add the users who should get access here.
This error means that the SAMLResponse sent back from the identity provider to anny is not signed. We always require a signed SAMLResponse. Make sure the signature is added in your IdP.
**Microsoft**
To enable the signature in Microsoft Azure, go to the application > Single sign-on > SAML Certificates > Edit. Make sure the "Sign SAML response and assertion" option is selected under signing options.
When signing in as an M365 admin via the wayfless link or by clicking the *Test Connection* button, it is important to note which user you are currently signed in with in M365. An admin user without a license for Exchange/Outlook and without their own email address cannot sign in to anny. First switch to your regular M365 account and run the sign-in process again.
In principle, no [attribute mapping](/en/attribute-mapping) is required for the SSO sign-in. However, it can be used later for automatic assignment to booking areas or roles. Mapping rules without content or assignment can cause errors during sign-in, because anny tries to apply the rules during the sign-in process.
Remove the rules you created and test the sign-in again.
If individual users are not assigned correctly through attribute mapping, the reason in Microsoft 365 can be that they are assigned to too many groups, so we cannot read out the groups.