<a id="az-oidc-sso"></a>

# Use Single Sign-On with Azure Marketplace on Confluent Cloud

When you create a Confluent Cloud organization through Azure Marketplace:

* Confluent enables single sign-on (SSO) for your organization based on OpenID
  Connect (OIDC) using the associated Microsoft Entra ID as the identity provider.
  OIDC is an authentication protocol that is built on top of the OAuth 2.0 framework
  for user identities.
* The SSO identity provider can be modified in the Confluent Cloud Console after the organization is connected to your Azure tenant.
* When using SSO with Azure Marketplace, OIDC SSO does not require manual updates to
  signing certificates, unlike SAML-based SSO.
* When SSO is enabled for an organization, a default group mapping (`all-sso-users`)
  is applied to all SSO user accounts and binds them to two predefined RBAC roles that
  provide the essential minimum permissions needed to access your organization’s Confluent Cloud
  resources. Note the following:
  * The default user group mapping does not require any permissions or user group
    information from Azure because its membership is all SSO user accounts in Confluent Cloud.
  * Default user permissions in the `all-sso-users` group mapping can be customized,
    or additional group mappings can be added by the organization owner or administrator.
  * For more information, see [Default user permissions](../../user-accounts/manage-sso-user-accounts.md#default-user-permissions).

On the **Single sign-on** page in the Confluent Cloud Console at
[https://confluent.cloud/sso](https://confluent.cloud/sso),
you can:

* Verify that SSO is enabled for your organization.
* Get the **Sign-On link** for your organization. This is the URL that you can
  use to sign in to your Confluent Cloud organization using SSO.

Note: With SSO through Azure Marketplace, the user identification is the email
address attribute in Microsoft Entra ID. If the email address attribute is not
available, the user identification is the user principal name (UPN) attribute is
used as the Confluent email address identifier.

## Sign in to Confluent Cloud using Azure SSO

To sign in to Confluent Cloud using Azure SSO:

1. Go to the **Sign-On link** for your organization on the **Single sign-on**
   page in the Confluent Cloud Console at
   [https://confluent.cloud/sso](https://confluent.cloud/sso).
2. Enter your Microsoft Entra ID credentials.
3. If this is your first time signing in to Confluent Cloud using Azure SSO, a
   **Permissions requested** dialog appears, requesting to:
   * Sign you in and read your profile
   * Read directory data

   These permissions allow Azure to send groups to Confluent Cloud for group mapping.

   Click **Accept**.

You are signed in to Confluent Cloud using Azure OIDC SSO.

<a id="edit-sso-settings"></a>

## Switch from Azure Marketplace SSO to SAML SSO

You can change from the default Confluent-managed SSO with Azure Marketplace by editing the SSO setting in the Confluent Cloud Console, and configuring SSO with your own SAML identity provider. You can enable SAML SSO with the same Microsoft Entra ID tenant, or use another identity provider that supports SAML SSO. Submitting the new SAML SSO configurations will disconnect the OIDC SSO connection, and this action is not reversible.

### Prerequisites

* A local user account with [OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role).
* SAML-based SSO is enabled for your organization. For more information, see
  [Enable SAML SSO on Confluent Cloud](enable-sso.md#enable-sso).

To edit Azure Marketplace SSO settings:

1. Go to the **Single sign-on** page in the Confluent Cloud Console at
   [https://confluent.cloud/sso](https://confluent.cloud/sso).

   You can also get to this page by opening the sidebar menu and clicking
   **Single sign-on**.
2. Click **Edit SSO settings**.
3. To configure SAML SSO, follow the steps in [Enable SAML SSO on Confluent Cloud](enable-sso.md#enable-sso).
4. Click **Submit** to save the changes.

### Troubleshooting

Below are some common issues and their solutions:

* If you see “You do not have permission to view this content” on the
  **Single sign-on** page, ensure that you have the
  [OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role).
* If editing the SSO settings fails with 405, 503, or 409 errors, retry
  editing again. If you continue to see errors, contact
  [Confluent Support](https://support.confluent.io).
* If you see “SSO with same name exists” on the **Single sign-on** page,
  change the SSO identifier and try again.