--- schema_version: "1" id: 4e27cb5c83f7d9227eb81c02168501fd051fb16cd0cd56af33219e44b16f6ba0 title: Single Sign-On Identity Provider Support collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_identity_providers.md canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_identity_providers.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: e6be68515008a64600172d99036d64b2ab5d198de8b06a8139ad4ad97d389b6a description: Marketing Cloud Engagement supports identity providers that use the Security Assertion Markup Language (SAML) 2.0 specification, such as Salesforce Identity, Shibboleth, PingFederate, and Active Directory Federation Services (AD FS). The identity provider must trust Engagement as a service provider, sometimes called a relying party. products: - Marketing - Marketing Cloud Engagement release: "264" --- # Single Sign-On Identity Provider Support Marketing Cloud Engagement supports identity providers that use the Security Assertion Markup Language (SAML) 2.0 specification, such as Salesforce Identity, Shibboleth, PingFederate, and Active Directory Federation Services (AD FS). The identity provider must trust Engagement as a service provider, sometimes called a relying party. ## Metadata Document Download the metadata document under Security Settings in the Administration section of your Engagement account. Engagement accepts and generates SHA1 and SHA256 signed requests, depending on your configuration. To use SHA256, you must have a tenant-specific endpoint, as opposed to a global endpoint. The metadata document describes a service provider to an identity provider. It includes the endpoint addresses for communication, the X.509 certificates used to encrypt and sign SAML assertions, and a list of supported SAML bindings. ## SAML Bindings Marketing Cloud Engagement supports the HTTP POST and HTTP Artifact bindings. ## Name Identifier Configure the identity provider to provide a unique identifier for Engagement users. The `` tag in the `` SAML assertions sent to Engagement must include the unique identifier. This unique identifier represents the shared identifier between the identity provider and Engagement. Common values include the user’s email address or login name. Use a `` tag to specify the format of the `` tag in the metadata of the identity provider and in the `` requests sent during login. Engagement supports four name ID formats. - `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` - `urn:oasis:names:tc:SAML:2.0:nameid-format:entity` - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified` - `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` ## Key Descriptors A key descriptor defines which keys to use to encrypt and sign SAML assertions. Engagement requires that all SAML assertions are signed using an X.509 certificate. The key is defined in metadata documents with the tag ``. #### See Also - [Marketing Cloud - Update Your Single Sign On (SSO) Login URL to Your Tenant’s Endpoint](https://help.salesforce.com/s/articleView?id=000392837&type=1&language=en_US) - [Updating Marketing Cloud Endpoints to Tenant Specific Endpoints: FAQ](https://help.salesforce.com/s/articleView?id=000392227&type=1&language=en_US)