# Single Sign-On and Identity Federation

Escape connects to your existing identity provider. You can:

- Use your current identity provider for authentication
- Centralize user management
- Enforce organizational security policies

## Supported Identity Providers

Escape supports the following enterprise authentication providers out of the box:

### Identity and Access Management

- [Active Directory/LDAP](<https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap>)
- [ADFS](<https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/adfs>)
- [Azure Active Directory](<https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/azure-active-directory/v2>)
- [Okta](<https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta>)
- [PingFederate](<https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/ping-federate>)

### Cloud and Workspace Providers

- [Google Workspace](<https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/google-apps>)

### Standards and Protocols

- [OpenID Connect](<https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/oidc>)
- [SAML 2.0](<https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/saml>)

## Advanced Authentication Features

### Multi-Factor Authentication (MFA)

Contact Escape support to configure organization-wide MFA enforcement.

### Granular Access Control

Manage permissions and project access in [Escape RBAC](<https://docs.escape.tech/documentation/enterprise/rbac/index.md>). Administrators assign roles in Escape.

### Automatic User Provisioning

Users signing in through your organization's configured SSO connection are created in Escape on first login. An administrator must assign their roles.

To complete offboarding after removing a user from your identity provider, [deactivate the member in Escape](<https://docs.escape.tech/documentation/enterprise/rbac/users-managment/#deactivating-a-member-from-the-organization>). Escape membership deactivation is a separate step.

## Getting Started

We handle the entire configuration process between your identity provider and Escape. Our team will:

1. Guide you through the setup
2. Verify your identity provider's configuration
3. Verify sign-in works with Escape

### SAML Configuration Exchange

To start the configuration, send us:

- Your sign-in URL
- Your X.509 signing certificate
- Your sign-out URL, if needed

In return, Escape provides:

- **Escape's certificate**: Use it to verify SAML messages signed by Escape.
- **Your Entity ID**: Identifies Escape as the SAML service provider in your identity provider configuration. Escape will provide your specific Entity ID during setup.
- **Your Assertion Consumer Service (ACS) URL**: Tells your identity provider where to send the SAML response for IdP-initiated SSO. Escape will provide your specific ACS URL during setup.

> [!TIP]
>
> **Third-Party Providers**
>
> Explore additional enterprise providers in the [Auth0 Marketplace](<https://marketplace.auth0.com/features/enterprise-connections>).

## Contact and Support

Ready to implement SSO? Reach out to our support team, and we'll help you get started quickly and securely.

- **Email**: [support@escape.tech](<mailto:support@escape.tech>)
- **Slack**: [Escape Community Slack](<https://slack.escape.tech>)