> For the complete documentation index, see [llms.txt](https://doc.engenius.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.engenius.ai/cloud-configuration-guide/topics/saml-sso-with-adfs/msp-portal-configuration.md).

# MSP Portal Configuration

{% hint style="success" %}

### Necessary Pre-requisite

* ADFS installation and initial setup are complete.
* Obtain the [**metadata file**](https://adfshelp.microsoft.com/MetadataExplorer/GetFederationMetadata) from ADFS.
* The MSP portal on EnGenius Cloud Platform is activated with an MSP license.
  {% endhint %}

## <mark style="color:blue;">Configure SAML SSO for the Organization</mark>&#x20;

1. Go to **Organization > MSP Portal > Teams > Team Management** and find the **SAML SSO** section.
2. Enable **SAML SSO**.

<div align="left"><figure><img src="/files/74XtI0wxVL9hrJws6KwX" alt="" width="255"><figcaption><p>1-1 SAML SSO</p></figcaption></figure></div>

3. Click on **Add** to create a new  “**IdP**" to input SAML identity provider details:

* Upload the **Identity Provider (IdP) Metadata** file, which you can extract from your ADFS server.
* Provide a **Name** that helps to identify this IdP.
* Provide the **Login URL**, which is the URL of the existing ADFS login page. &#x20;

<div align="left"><figure><img src="/files/ZZ6UddgjVIzyR2e1SMBt" alt="" width="563"><figcaption><p>1-2 Add IdP</p></figcaption></figure></div>

{% hint style="info" %}
**IdP Metadata for SSO Integration**

**Metadata** for an IdP is a data file containing the IdP's unique identifier, service URLs, public key certificates, and supported communication protocols, used to enable secure SSO connections.
{% endhint %}

{% hint style="info" %}
**Logout URL for Auto-Logout Redirection**

The 'Logout URL' allows users to set a specific webpage to redirect to after a defined period of inactivity, ensuring an automatic and secure logout.
{% endhint %}

4. &#x20;Upon creation of IdP, the system auto-generates the **Consumer URL** for where the IdP user data will be sent post-IdP authentication.

<figure><img src="/files/dZQQ1I9eDlPFClSSTLUH" alt=""><figcaption><p>1-3 Consumer URL</p></figcaption></figure>

{% hint style="info" %}
Record the "**Consumer URL"** as it is essential for future ADFS configuration.
{% endhint %}

5. Customize the EnGenius **SSO Login URL**:  Adjust the ending URL for easier recall. It serves as a direct link to the default IdP and is unique to a single IdP.

<div align="left"><figure><img src="/files/fKVeDIDRq2FNUbgXWKjE" alt=""><figcaption><p>1-4 SSO Login URL</p></figcaption></figure></div>

6. Select a **Default IdP** from the IdP list, it will associate to EnGenius Cloud SSO page as the redirect IdP when user tries to login through SSO URL.

<div align="left"><figure><img src="/files/TvzDNn7GLBWC3JmN9VDl" alt="" width="563"><figcaption><p>1-5 Default IdP</p></figcaption></figure></div>

{% hint style="info" %}
**Multi-IDP SAML SSO Configuration**

You can manage and create several IdPs in the EnGenius Cloud to establish SAML SSO, each with its unique Login and Consumer URLs, but only one can map to the SSO Login shorthand URL.
{% endhint %}

## <mark style="color:blue;">Create SAML Roles</mark>&#x20;

Navigate to **Organization > MSP Portal > Teams > Team Privilege** to access the SAML administrator roles. Use this to assign user group privileges. SAML users receive permissions based on the 'role' attribute in their SAML token from the IdP.

To set up a new role for the IdP:

1. Click "**Add Team**".
2. Assign managed scope and permissions as you would for standard users.
3. To finalize, click "**Create admin**" and "**Save changes**".

<figure><img src="/files/wzEYlwJBxfWNqT48R50k" alt=""><figcaption><p>1-6 Team Privilege</p></figcaption></figure>

{% hint style="info" %}
The new team is set by default to the "**All Org**" scope with "**Admin**" permissions; however, customization for individual organizations is possible.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://doc.engenius.ai/cloud-configuration-guide/topics/saml-sso-with-adfs/msp-portal-configuration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.