> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Single Sign-On with Azure Active Directory

> Set up SAML Single Sign-On for ABBYY FlexiCapture Cloud with Azure Active Directory by creating an enterprise application and exporting the certificate.

You can set up SAML-based Single Sign-On for ABBYY FlexiCapture Cloud web stations using Azure Active Directory. First register an application in Azure Active Directory, and then provide the configuration details to cloud support.

## Register an application in Azure Active Directory

<Steps>
  <Step title="Open the Azure portal">
    Go to [https://portal.azure.com/](https://portal.azure.com/) and log in to your Microsoft Azure account.
  </Step>

  <Step title="Open Enterprise applications">
    Go to the **Azure Active Directory > Enterprise applications** section.
  </Step>

  <Step title="Add a non-gallery application">
    In the **Add an application** window, go to the **Non-gallery application** section and specify a name for the new application. If several tenants are used, create a separate application for each.

    <Frame>
      <img src="https://mintcdn.com/abbyy/mpS3pcxC_lkohQUS/images/flexi-capture/SSO1.jpg?fit=max&auto=format&n=mpS3pcxC_lkohQUS&q=85&s=56a6b9ecfeae33903123d204b2cd7b85" alt="Screenshot of the Add an application window in the Microsoft Azure portal, with the Non-gallery application option and the Name field for the new application." width="1265" height="823" data-path="images/flexi-capture/SSO1.jpg" />
    </Frame>
  </Step>

  <Step title="Add users and groups">
    Go to the **Users and groups** section and add all required users. Give them the **User** role.
  </Step>

  <Step title="Select the SAML sign-on method">
    Go to the **Single sign-on** subsection and select **SAML**.

    <Frame>
      <img src="https://mintcdn.com/abbyy/mpS3pcxC_lkohQUS/images/flexi-capture/SSO2.jpg?fit=max&auto=format&n=mpS3pcxC_lkohQUS&q=85&s=0dab4fad2d45199f7013cdc440955d2b" alt="Screenshot of the Single sign-on subsection in the Microsoft Azure portal, with the SAML method selected." width="1265" height="823" data-path="images/flexi-capture/SSO2.jpg" />
    </Frame>
  </Step>

  <Step title="Configure the Basic SAML settings">
    Edit the **Basic SAML Configuration** section. In the **Identifier (Entity ID)** and **Reply URL (Assertion Consumer Service URL)** fields, enter the URL in the following format, and leave the rest of the fields blank:

    ```text theme={null}
    https://<cloud-host-name>/FlexiCapture12/Login/<TenantName>/AccessToken/Saml
    ```

    Here, `<cloud-host-name>` is the host name of the SaaS URL of your [processing location](https://flexicapture.com/data-processing-location/), and `<TenantName>` is the name of your tenant in FlexiCapture Cloud.

    <Frame>
      <img src="https://mintcdn.com/abbyy/mpS3pcxC_lkohQUS/images/flexi-capture/SSO3.jpg?fit=max&auto=format&n=mpS3pcxC_lkohQUS&q=85&s=253d75516277445931fbbd9027c6cb4c" alt="Screenshot of the Basic SAML Configuration section on the Set up Single Sign-On with SAML page in the Microsoft Azure portal." width="1268" height="1040" data-path="images/flexi-capture/SSO3.jpg" />
    </Frame>
  </Step>

  <Step title="Download the public certificate">
    In the **SAML Signing Certificate** section, download your public certificate in Base64 format by clicking the link next to **Certificate (Base64)**.
  </Step>

  <Step title="Copy the login URL">
    From the **Login URL** field in the **Set up \[application name]** section, copy the URL for accessing the server of the external identity provider.
  </Step>
</Steps>

## Provide details to cloud support

Provide the following information to cloud support or the account manager:

* The URL of your FlexiCapture Cloud region and your tenant name
* The public key certificate
* The login URL
* The image for the new **Log in with…** button (images in `.svg`, `.jpg`, and `.png` formats are supported)
* The name of the external identity for the **Log in with…** button

Once cloud support completes the setup, an additional login button appears on your login page: **Log in with \[IdP Name]**.

<Note>
  For more technical details about the SAML authentication requests and responses that Azure Active Directory supports for Single Sign-On, see [this article on Microsoft.com](https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol).
</Note>