> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firstresonance.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> The life of an SSO connection in ION: set it up, keep its certificate current, and retire it.

An SSO connection hands authentication to your identity provider (Okta, Microsoft Entra ID, Google Workspace, ADFS, or another SAML or OIDC provider) and has a life beyond initial setup:

1. **Set up**: after verifying your domain, you connect your IdP through a self-service wizard that exchanges SAML or OIDC details and maps user attributes. See [Set up SSO](/administration/authentication-settings/sso/set-up-sso).
2. **Maintain**: SAML connections verify each login against your IdP's signing certificate. When that certificate expires or your security team rotates it, you update ION with the new one, coordinated with the IdP switch. OIDC keys rotate automatically. See [Rotate your SAML signing certificate](/administration/authentication-settings/sso/rotate-saml-certificate).
3. **Retire**: disabling SSO removes the connection and returns your team to email and password sign-in without deleting any accounts. See [Disable SSO](/administration/authentication-settings/sso/disable-sso).

<Warning>
  A misconfigured SSO connection or an out-of-sync certificate rotation blocks fresh sign-ins to production. Validate authentication changes in a sandbox tenant when you have one, and keep the previous certificate on hand during a rotation.
</Warning>