--- schema_version: "1" id: 1b0e35c0632883f6b1d2eb4ff231dc6d14b50a3635bb83ccaf58ca43e176e5df title: Managing External Identity Providers in Anypoint Platform collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/access-management/external-identity-index.md canonical_url: https://docs.mulesoft.com/access-management/external-identity-index source_site: docs.mulesoft.com content_type: documentation content_hash: e981d0b7912481f2c9121c28d076b6e12c5c694e08ac4925178883a7e6c1b884 description: MuleSoft Documentation Site latest: true --- --- product: Access Management version: master --- # Managing External Identity Providers in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure up to 25 external identity providers (IdPs) in Anypoint Platform to enable single sign-on (SSO) for your organization. Anypoint Platform supports SAML 2.0 and OpenID Connect (OIDC) configurations for SSO providers. If you are using the Access Management API, note the following: - Old endpoints that aren’t scoped to new IdPs are replaced with new endpoints. - IdPs created before October 31, 2021 are backwards compatible with old endpoints. - If a legacy IdP is deleted, then old endpoints are no longer supported, even if the legacy IdP is re-added. ## Managing User Identities with Anypoint Platform By default, user identities and credentials in your Anypoint Platform organization are managed by Anypoint Platform in Access Management. You can disable this functionality after you add one or more external identity providers. Organizations that use Anypoint Platform to manage user identities control whether new users are added to the organization using either Access Management settings or an external identity provider. Organizations that don’t require multi-factor authentication (MFA) for their user accounts choose to enable or disable MFA and exempt accounts. If an organization requires MFA, administrators manage exempt accounts in the **Identity Providers** section using the **Anypoint** settings. ## Before You Begin Before getting started, ensure that you have: - The Organization Administrator permission - An OpenID Connect or SAML 2.0 identity provider ## Manage Identity Providers Access your list of identity providers, configure settings, and add additional identity providers. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. A list of identity providers appears. ## Add Identity Providers 1. Click **Add Identity Provider**, and then select the identity provider type you want to add: - [OpenID Connect](https://docs.mulesoft.com/access-management/conf-openid-connect-task) - [SAML 2.0](https://docs.mulesoft.com/access-management/conf-saml-sso) ## Delete Identity Providers If you have more than one identity provider configured, delete external identity providers that you no longer need. Before deleting an IdP, ensure that your users' credentials and permissions structures are configured with a different IdP, such as the native Anypoint Platform IdP or an external IdP. When you delete an IdP: - Users can no longer use this IdP to sign in to Anypoint Platform. - Any external team or role group mappings associated with this IdP are deleted. - The Access Management API endpoints associated with this IdP are no longer supported. To delete an identity provider: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Next to the identity provider to delete, click the **…​** menu. 5. Click **Delete…​** 6. In the **API Update** window, click **Continue**. 7. Enter the name of your identity provider. 8. Click **Delete**. ## Enable Users to Link Anypoint Platform Profiles As an organization administrator, you can enable users to link multiple Anypoint Platform profiles that use the same email address to sign in. The option to link profiles is available only when the SSO user signs in to their new Anypoint Platform account for the first time. Anypoint Platform supports: - Linking an SSO signin to a local profile by using credentials (signin managed by Anypoint IdP) - Linking an SSO signin to another SSO signin that uses a different IdP - Linking an SSO signin to multiple other profiles that use different IdPs Anypoint Platform doesn’t support linking multiple profiles that use the same IdP. Anypoint Platform supports only OpenID Connect (OIDC) IdPs. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. In the **Link Multiple SSO Profiles** section, click **Enabled**. 5. Click **Save Changes**. Users in your organization can now link their SSO logins with other IdP profiles that share the same email address. ## Remove a Linked Profile From a User Account To remove a linked profile from a user account, organization administrators make a `DELETE` call to `/accounts/api/organizations/:orgId/users/:userId/identityProviderProfiles`. For details, see the [Access Management API documentation](https://dev-portal.mulesoft.com/apis/access-management.html). ## Enable or Disable Account Creation If your organization has single sign-on (SSO) using an [external identity provider](https://docs.mulesoft.com/access-management/external-identity) enabled, you can prevent users from creating accounts that do not use SSO. To modify account creation parameters: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Click **Anypoint**. 5. Select one of the following: 1. **Allow account creation**: Organization administrators can invite new users using the **Users** tab. Accounts created using this feature belong to the Anypoint identity provider and sign in using their credentials rather than SSO. 2. **Disable account creation**: New accounts must join the organization using an external identity provider and sign in using SSO. Existing accounts are unaffected and can continue to sign in using their credentials. 6. Click **Save Changes**.