> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Configure Google, GitHub and Entra ID sign-in for a self-hosted deployment.

# How to modify SSO settings

Users with the On-prem Administrator role can modify the single sign-on (SSO) settings. By enabling an SSO provider, users will be able to login via their preferred identity provider.

1. Go to **On-prem settings** page
   * Click on **On-prem** from the navigation menu, then **Settings**
2. The SSO settings for Google, GitHub and Entra ID will be part of the settings page

<Frame>
  <img src="https://mintcdn.com/cymph/KPJNfBouluLFW1-R/images/sso_settings.png?fit=max&auto=format&n=KPJNfBouluLFW1-R&q=85&s=b3d6637b68cf9009a19ad52b3e14bb74" alt="Sso Settings" width="3440" height="1718" data-path="images/sso_settings.png" />
</Frame>

3. You can click the **Edit** button next to the desired provider and change its settings

# Google SSO  setup

Google SSO setup requires a client ID and a client secret from the registered OAuth application. You can see the detailed documentation [here](https://support.google.com/cloud/answer/15549257?hl=en\&visit_id=639214779272767205-531342223\&rd=1).

During OAuth app registration, make sure that homepage is set to `https://demo-instance.cymph.io/` and auth callback to `https://demo-instance.cymph.io/api/auth/callback/google`

Replace `demo-instance.cymph.io` with the FQDN of your installation.

# GitHub SSO setup

GitHub SSO setup requires a client ID and a client secret from the registered OAuth application.

Go to [github.com](https://github.com) and switch context to the desired organisation. Go to Developer Settings and then to OAuth apps to register a new OAuth application.

During OAuth app registration, make sure that homepage is set to `https://demo-instance.cymph.io/` and auth callback to `https://demo-instance.cymph.io/api/auth/callback/github`

Replace `demo-instance.cymph.io` with the FQDN of your installation.

# Entra ID SSO setup

The Entra ID SSO setup requires a Client ID, Tenant ID and a Client Secret from a registered application.

**1. Create an App Registration**

* Go to portal.azure.com → **Microsoft Entra ID** → **App registrations** → **New registration**
* Name it (e.g. "Cymph")
* Supported account types: **Accounts in any organizational directory and personal Microsoft accounts** (this matches `tenantId: "common"`)
* Redirect URI: `Web` → `https://demo-instance.cymph.io/api/auth/callback/azure-ad`
  * Replace `demo-instance.cymph.io` with the FQDN of your installation.

**2. Get the Client ID and Tenant ID**

* After registration, on the **Overview** page copy:
  * **Application (client) ID**
  * **Directory (tenant) ID** → not needed since you're using `"common"`, but good to note

**3. Create a Client Secret**

* Go to **Certificates & secrets** → **New client secret**
* Set an expiry, click **Add**
* Copy the **Value** immediately (it's only shown once)

**4. Set Required API Permissions** (usually already set by default)

* **API permissions** → ensure `Microsoft Graph` → `User.Read` is present (it is by default)

No admin consent needed for `User.Read` on a public app.