Note the following before proceeding with the set up:

1. Keep below information related to your Identity provider (IDP) handy:
   • IDP sign in URL
   • IDP public key
2. We recommend admins to involve their IT counterparts to facilitate the setup process for SSO
3. If the organization is structured within a parent-child hierarchy, SSO should be enabled at the parent level. The option to enable SSO at the child level will be disabled in this case.
4. If the org has multiple dashboards, please work with your sales rep to link all dashboards to one parent dashboard and enable SSO at parent level

Once you have ensured the above, you can set up SSO on the dashboard for people in administrative roles by following the steps below:

1. Navigate to SSO card in the Integration tab on dashboard
   • Click on the Profile icon on the dashboard to navigate to Settings → Integrations tab
   • Click on “Manage SSO” on the SSO card to start the setup process

2. Add and verify company domains

   • Click on “Select Domain” to “Add” and verify company domains. Only accounts belonging to these verified domains will have the ability to use SSO.
   • Once the domains are added, Click on “Verify” and update the verification TXT record provided on the company’s DNS.
   • Click on “Check DNS record” to complete domain verification
   • Status of the domains will change to “verified” on successful verification

   To learn more about why this step is needed, refer to section named “Domain Ownership Verification”

3. Set up SSO metadata and Enable SSO
   • Click on “Set up SSO metadata” to update IDP sign in URL & public key. To learn more on how to get these details for your IDP, please refer to our tech docs.
   • Once metadata information is updated, click on “Enable SSO” to enable SSO at organization level. Note this step will not enable SSO for any users.

4. A) Enable SSO for all or specific people
   • Click on “Manage custom audience” to enable access for all or specific people in administrative roles (like admins, coordinators, reviewers etc.)
   • After enabling SSO, the screen will display their status. People with existing Uber accounts on their work email may need to replace the email or provide consent for the creation of a business account. These people will be listed in the ‘Needs Action’ section.
   • Additional steps to be performed on IDP side:
     • Assign SSO users to the U4B application on IDP instance
     • Update IDP level configuration as detailed in the section named Configuring your Identity Provider

4. B) Enable SSO for all or specific orgs (In case the SSO set up is being done at parent level)
   • For parent-level SSO setup, admins have the option to enable it for either all organizations or specific ones.
   • Additionally, they can choose to enable SSO for all users or specific people. Note: Individual people can only be selected within each child organization.

5. Once the above steps are completed, the SSO-enabled users will receive an email for business account creation. In case, you need to retrigger emails for business account creation, please follow the steps below:
   • Note: Once enabled for SSO, their status will be visible in the Manage access section
     • Enabled: Business account creation is complete and SSO is enabled.
     • Needs action: These users have an existing Uber account on their work email and will be required to free up work email for business account creation. They can do this by selecting one of the below options in the invite email sent.
       • replacing the work email with personal one on existing account OR
       • providing consent to update their existing account to a business account.
   • Select the users requiring an additional action and click on “Resend invite” to retrigger the email for business account creation