# Single Sign-On (SSO)

Single Sign-On (SSO) lets users authenticate to epilot using credentials from your identity provider instead of separate epilot passwords.

epilot supports **OIDC**-based SSO.

## Configure SSO

### Create a provider

1. Go to **Settings** > **Single Sign On** in the epilot portal.

> **Info: If the SSO option is not visible, contact customer success to enable it for your organization.**

![SSO menu](/img/sso/sso-menu.png)

2. The SSO page lists all configured providers. Click **Create new provider** to add one.

![SSO page](/img/sso/sso-page.png)

### Attribute mappings

Select **OIDC** as the provider type and configure attribute mappings for `email`, `display name`, `phone number`, and `language` from the token payload.

![SSO attribute mappings](/img/sso/sso-add-new.png)

### Role mappings

Map token claims to epilot roles. Set a **default role** that applies when no mapping matches.

When **Dynamic Role Mapping** is enabled, roles sync on every SSO login. When disabled, roles are only mapped on the user's first SSO login.

![SSO role mappings](/img/sso/sso-role-mapping.png)

### OIDC configuration

Create an app registration in your identity provider (e.g. Microsoft Entra ID). Add the platform as **Single Page Application** with the redirect URL:

```
https://portal.epilot.cloud/sso
```

![SSO redirect](/img/sso/sso-redirect.png)

Create a client secret and enter the `OIDC Issuer URL`, `Client ID`, `Client Secret`, and `Scope`.

![SSO OIDC](/img/sso/sso-oidc.png)

Click **Save**. Copy the login URL from the saved configuration to enable direct SSO login.