> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Single Sign-On

> Configure Single Sign-On for ABBYY FlexiCapture Cloud by creating an identity provider application, setting the ACS URL, and supplying the certificate.

<Steps>
  <Step title="Create an application in the identity provider">
    Create an application in the identity provider.
  </Step>

  <Step title="Enable Single Sign-On in the identity provider">
    Enable the Single Sign-On authentication method in the identity provider.
  </Step>

  <Step title="Specify the ACS URL">
    In the application settings, specify the ACS URL (Assertion Consumer Service URL) that sends the Identifier (Entity ID) and an assertion message back to ABBYY FlexiCapture Cloud when authentication succeeds. These values must contain identical URLs.

    Specify the URLs in the following format:

    ```text theme={null}
    https://<cloud-host-name>/FlexiCapture12/Login/<TenantName>/AccessToken/Saml
    ```

    Here, `<cloud-host-name>` is the host name of the SaaS URL of your [processing location](https://flexicapture.com/data-processing-location/), and `<TenantName>` is the name of your tenant in ABBYY FlexiCapture Cloud.

    For example, a user in the `john_doe` tenant using a European FlexiCapture Cloud instance would use the following URL:

    ```text theme={null}
    https://europe.flexicapture.com/FlexiCapture12/Login/john_doe/AccessToken/Saml
    ```
  </Step>

  <Step title="Save the certificate and login URL">
    Save the public key certificate in Base64 format and the login URL that the application uses to access the external identity provider.
  </Step>

  <Step title="Send the details to cloud support">
    Provide the following information to cloud support or the account manager:

    * The URL of your FlexiCapture Cloud region and your tenant name
    * The public key certificate
    * The login URL
    * The image for the new **Log in with…** button (images in `.svg`, `.jpg`, and `.png` formats are supported)
    * The name of the external identity for the **Log in with…** button
  </Step>
</Steps>

Once cloud support completes the setup, an additional login button appears on your login page: **Log in with \[IdP Name]**.

## Grant permissions to new user accounts when using external identity providers

When a new user logs in to ABBYY FlexiCapture Cloud using an external identity provider or SSO, a new account is created in ABBYY FlexiCapture without any permissions. The tenant administrator needs to grant the new account permissions or add it to the appropriate user groups. For more information about accounts and permissions, see [User roles and permissions](/flexi-capture/web-stations/monitoring-console/permissions).

To delete or modify the external identity providers in your tenant, contact technical support.