---
schema_version: "1"
id: 937fdbdbe22a90e049e4083e4e533ac329cd5c6eb210184f3f8342134299b2ef
title: Enable Salesforce as a SAML Identity Provider
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/identity_provider_enable.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_enable.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c511f332d2356a649b37c93e922af4fe473861e9da54899acb0b9eeb0c53c520
description: You can configure Salesforce as a single sign-on (SSO) SAML identity provider to external service providers. When your org acts as a SAML identity provider, users can access multiple apps with a single login. To get started with this configuration, enable Salesforce as an identity provider and share configuration information with your service provider.
products:
  - Security
release: "264"
---
# Enable Salesforce as a SAML Identity Provider

You can configure Salesforce as a single sign-on (SSO) SAML identity provider to external service providers. When your org acts as a SAML identity provider, users can access multiple apps with a single login. To get started with this configuration, enable Salesforce as an identity provider and share configuration information with your service provider.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Developer</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Database.com</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d13723e73">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d13723e73 ">Define and modify identity providers and service providers:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d13723e73 ">Customize Application</td>

          </tr>
        </tbody>
      </table>

Determine which certificate you want to use to enable your org to communicate with the service provider. You can use the default certificate or create your own. See [Certificates and Keys](https://help.salesforce.com/articleView?id=security_keys_about.htm&language=en_US).

- By default, a Salesforce identity provider uses a self-signed certificate generated with the SHA-256 signature algorithm. If you want to use the default certificate, proceed to step 1.
- To create a self-signed certificate, follow the instructions in [Generate a Self-Signed Certificate](https://help.salesforce.com/articleView?id=security_keys_creating.htm&language=en_US) , then proceed to step 1.
- To create a CA-signed certificate, follow the instructions in [Generate a Certificate Signed by a Certificate Authority](https://help.salesforce.com/articleView?id=security_keys_uploading_signed_cert.htm&language=en_US), then proceed to step 1.

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Identity Provider**.
2. Click **Enable Identity Provider**.
3. Select a certificate from the dropdown menu.
4. Save your changes.

To review your identity provider information, from [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Identity Provider**.

From this page, you can take these actions.

- To change your identity provider certificate, click **Edit**.
    
    ![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_warning.png)
    
    Warning If you change the certificate, you potentially disable access to external applications. To validate the new certificate information, you can update all external applications.
- To disable your org as an identity provider, click **Disable**.
    
    ![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_warning.png)
    
    Warning If you disable your org as an identity provider, users can no longer access any external applications with SSO.
- To download your identity provider certificate, click **Download Certificate**. Your service provider can use the certificate to connect to Salesforce.
- To download an XML file with metadata about your identity provider, click **Download Metadata**. Your service provider can use the metadata to connect to Salesforce.
- In the Details section, view the Issuer, which is the unique identifier for your Salesforce identity provider.
- In the SAML Metadata Discovery Endpoints section, access the identity provider metadata for your custom domain and any Experience Cloud sites. Some service providers use these URLs to configure SSO to connect to Salesforce. For example, when configuring Amazon Web Services (AWS) as a service provider, you upload your Salesforce identity provider metadata to AWS.
    
    You can find the identity provider metadata for a custom domain or site in these fields:
    
    - Salesforce Identity—URL of identity provider metadata for your custom domain.
    - Community Identity—URL of identity provider metadata for a specific Experience Cloud site. For example, if you set up a site named XYZ, you see XYZ Community Identity.

Salesforce also defines a lifetime for SAML assertions sent to your service provider. A SAML assertion sent by a Salesforce identity provider is valid for 5 minutes after it's issued, with a 30-second buffer to account for clock skew. For example, if the assertion is issued at 12:00:00 GMT, it's valid between 11:59:30 GMT and 12:05:00 GMT. If the service provider receives the SAML response outside of this interval, it typically rejects the assertion.

After you enable Salesforce as an identity provider, complete these steps.

- [Complete prerequisites for integrating service providers.](https://help.salesforce.com/s/articleView?id=xcloud.service_provider_prerequisites.htm&release=264.0.0&type=5 "Before integrating a service provider with Salesforce, enable your org as an identity provider and exchange SAML single sign-on (SSO) information with your service provider.")
- [Integrate your service provider as a SAML-enabled app.](https://help.salesforce.com/s/articleView?id=xcloud.service_provider_define.htm&release=264.0.0&type=5 "To configure SAML single sign-on (SSO) with Salesforce as an identity provider, integrate a service provider by using the external client apps framework or the connected apps framework. With this SSO configuration, users log in to the service provider by using the same credentials that they use to log in to your Salesforce org or Experience Cloud site. To change your service provider details, edit your app. Control which users can access your app by managing profiles and permission sets.")
- [Map Salesforce users to the service provider.](https://help.salesforce.com/s/articleView?id=xcloud.service_provider_map_users.htm&release=264.0.0&type=5 "To ensure that your SAML service provider can recognize Salesforce users when they log in with single sign-on (SSO), update user information in Salesforce. Provide user identifiers that the service provider recognizes.")

#### See Also

- [SAML Single Sign-On Flows](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_about.htm&release=264.0.0&type=5 "When you set up single sign-on (SSO) with Security Assertion Markup Language (SAML), you can initiate login from the service provider or the identity provider. Service provider-initiated login and identity provider-initiated login use different flows, but both result in the user being logged in to the service provider.")
- [Generate a Self-Signed Certificate](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_creating.htm&release=264.0.0&type=5 "Generate a certificate signed by Salesforce to show that communications purporting to come from your organization are really coming from there.")
- [Create a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create.htm&type=5&language=en_US)