# How to Configure and Enable Operator SSO Using Microsoft Entra

HTML version: [How to Configure and Enable Operator SSO Using Microsoft Entra](https://support.gladstonesoftware.cloud/sso/how-to-configure-and-enable-operator-sso-using-microsoft-entra)

## Problem
You need to set up or review Single Sign-On (SSO) for Operator so that users can log in using their Microsoft Entra (Azure) credentials. This guide walks you through preparing your Gladstone environment, linking user accounts, and enabling SSO.

## Resolution
1. **Prepare User Accounts**
    - Ensure all existing Gladstone user accounts in Operator have email addresses that match their Microsoft Entra account email addresses.
      - If emails do not match, duplicate users without permissions may be created.

2. **Configure Users and Permissions**
    - Existing users are linked via matching email addresses.
    - If a user logs in via Microsoft Entra and does not exist in Gladstone, auto-provisioning creates a new user with:
        - Auto-generated User ID (8 characters)
        - Auto-generated secure password
        - Force password reset enabled
        - No user roles assigned
        - Display name set to the Entra user's first and last name
        - Email address from Entra user
        - Site Group set to All sites
        - User Group ID set to STAND

3. **Enable SSO in Microsoft Entra**
    - Go to your configured Enterprise Application in Microsoft Entra.
    - Open the Single Sign-On settings.

4. **Retrieve App Federation Metadata URL**
    - In the SAML Certificates section, copy the App Federation Metadata URL.

5. **Configure SSO in Operator**
    - In Operator, go to **Configuration > Integrations > Single Sign-On**.
    - Paste the Metadata URL into the **Authentication SAML Federation Metadata URL** field.

6. **Assign User Group in Microsoft Entra**
    - In Microsoft Entra, navigate to the Enterprise Application.
    - Select **Manage > Users and Groups**.
    - Select the group containing your staff (Back Office) users.

7. **Retrieve Group Object ID**
    - Copy the Object ID for this group.

8. **Configure Staff SSO in Operator**
    - In Operator, return to **Configuration > Integrations > Single Sign-On**.
    - Enable the Staff SSO option.
    - Paste the Group Object ID.

9. **Save the Configuration**
    - Click **Save** to apply your changes.

## Notes
- **There is no facility to provide the password to users created via auto-provisioning.** If users need to log in with a user ID and password (not SSO), another user with appropriate permission can reset the password in Plus2.
- **Troubleshooting:**
    - If users are created without permissions or duplicate users are appearing, make sure that user email addresses match between Gladstone and Microsoft Entra.
    - If a user cannot access Operator, check that they:
        - Have the correct roles assigned in the GMC.
        - Are included in the Entra Group being used for Staff SSO.
- **Related Articles:**
    - Single Sign-On (SSO): How to configure your Microsoft Entra account
    - Single Sign-On (SSO): The Consumer SSO experience
    - Single Sign-On (SSO): How to configure Gladstone products for Consumer SSO