> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Single Sign-On authentication

> Configure Single Sign-On for ABBYY FlexiCapture web stations: add identity provider configurations, assign groups by SSO, and enforce SSO-only mode.

<Info>
  Single Sign-On (SSO) authentication is supported only for web stations.
</Info>

Users authenticate when they start a station. They can use their ABBYY FlexiCapture user name and password, or an external [identity provider](/flexi-capture/appendix/glossary-main-body#idp) such as Azure Active Directory integrated with your corporate Active Directory.

## Add an identity provider

Before you begin, create and set up an application in the identity provider. For more information, see [Single Sign-On authentication](/flexi-capture/sso-intro).

<Steps>
  <Step title="Launch the console">
    Launch the Administration and Monitoring Console.

    <Info>
      Only the ABBYY FlexiCapture administrator can configure Single Sign-On on the default tenant. On other tenants, tenant administrators can configure it.
    </Info>
  </Step>

  <Step title="Open Single Sign-On settings">
    Go to **Settings → Single Sign-On**.
  </Step>

  <Step title="Add a configuration">
    Click **Add Configuration**.
  </Step>

  <Step title="Specify the parameters">
    In the dialog box that opens, specify the required parameters:

    * **Name** – The identity provider's name, shown on the **Log in with…** button.
    * **Reference** – The URL of the external identity provider's server.
    * **Upload Image File** – The path to the button image (`*.svg`, `*.jpg`, or `*.png`).
    * **Upload Certificate File** – The path to the public certificate.
  </Step>

  <Step title="Save the configuration">
    Click **OK**. The new configuration is added to the list. To change it, click **Edit**.

    <Info>
      You can specify multiple identity providers.
    </Info>
  </Step>
</Steps>

A **Log in with \[IdP Name]** button then appears on the station's login page.

Users need appropriate permissions to use ABBYY FlexiCapture. For more information, see [User roles and permissions](/flexi-capture/web-stations/monitoring-console/permissions).

## Assign groups by SSO

You can create ABBYY FlexiCapture groups from the groups in your identity provider (IdP). Users are added automatically, and a group updates when its IdP group changes.

<Info>
  Only the tenant administrator can assign groups. For the default tenant, only the ABBYY FlexiCapture administrator can change this setting.
</Info>

<Steps>
  <Step title="Enable group assignment">
    Go to **Settings → Single Sign-On** and select the **Assign groups by SSO** option.
  </Step>

  <Step title="Map the IdP group">
    When creating a new group, enter the GUID of the corresponding IdP group in the **External ID** field.
  </Step>
</Steps>

When users from that IdP group log in through SSO, they are added to the ABBYY FlexiCapture group automatically.

## SSO-only authentication mode

Use SSO-only authentication mode in high-security environments, where all access must be controlled centrally to avoid errors when granting permissions.

<Info>
  SSO-only authentication can only be enabled for non-default tenants.
</Info>

To enable SSO-only authentication, go to **Settings → Single Sign-On** and select the **SSO-only authentication mode** option.

When this mode is enabled, only users authenticated through an external identity provider can access the system. Creating and importing users in the Administration and Monitoring Console is disabled.