> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage SSO

> Edit, disconnect, or delete your Ravenna SSO connection, replace an expiring SAML certificate, enforce SSO-only sign-in, and monitor sign-in activity.

After you [set up SSO](/integrations/sso/setup), manage the connection from **Settings > SSO**. You need organization admin access.

## Check the connection status

The **Single Sign-On** card on **Settings > SSO** shows your connection and its status.

| Status | What it means |
| - | - |
| <Badge color="green" size="sm" stroke>Connected</Badge> | SSO is on. The card shows your **SSO Login URL** and the **Enforce SSO-Only Authentication** section. |
| <Badge color="orange" size="sm" stroke>Not Connected</Badge> | The connection is set up but turned off, for example after you disconnect it. Click **Connect** to turn it back on. |

<Frame>
  <img src="https://mintcdn.com/ravenna/SEDjSVZXxPLKc-Ak/images/integrations/sso/13-sso-connected.jpg?fit=max&auto=format&n=SEDjSVZXxPLKc-Ak&q=85&s=3a70b8ec584a52420132b6cde91217ce" alt="Okta example: the SSO settings page showing Okta SSO as Connected, the SSO login URL, and Enforce SSO-Only Authentication marked Enforced" width="3840" height="2408" data-path="images/integrations/sso/13-sso-connected.jpg" />
</Frame>

## Edit the connection

Edit the connection when your IdP's details change, such as a new signing certificate or client secret, or to change your domains.

<Steps>
  <Step title="Open the connection menu">
    On **Settings > SSO**, click the **Connected** dropdown and select **Edit**.

    <Frame>
      <img src="https://mintcdn.com/ravenna/SEDjSVZXxPLKc-Ak/images/integrations/sso/14-connected-dropdown.jpg?fit=max&auto=format&n=SEDjSVZXxPLKc-Ak&q=85&s=300340f60b995985689bf917e5f58aa7" alt="The Connected dropdown open with Edit, Disconnect, and Delete options" width="3840" height="2408" data-path="images/integrations/sso/14-connected-dropdown.jpg" />
    </Frame>
  </Step>

  <Step title="Update the details in the wizard">
    The setup wizard opens in a new tab. Update the connection details or domains the same way you entered them during [setup](/integrations/sso/setup#configure-your-identity-provider).
  </Step>

  <Step title="Test the connection">
    Click **Test Connection** to confirm users can still sign in, then click **Done**.
  </Step>
</Steps>

### Replace an expiring SAML certificate

SAML providers sign each sign-in with a certificate that expires. If it expires before you replace it, no one can sign in until you update it. OIDC connections don't use a certificate you manage.

<Steps>
  <Step title="Generate a new certificate in your IdP">
    Create the new signing certificate for the Ravenna application before the current one expires.
  </Step>

  <Step title="Replace it in Ravenna">
    [Edit the connection](#edit-the-connection) and replace the old certificate with the new one.
  </Step>

  <Step title="Test the connection">
    Click **Test Connection** in the wizard, then click **Done**.
  </Step>
</Steps>

## Enforce SSO-only sign-in

<Note>
  Ravenna doesn't turn on other sign-in methods by default, so for most organizations **Enforce SSO-Only Authentication** already shows **Enforced** and there's nothing to do.
</Note>

If your organization has other sign-in methods turned on, such as email and password or Google, the section says so and the switch is available. Turning it on turns those methods off for everyone in your organization.

<Warning>
  You can't turn enforcement off. To let users sign in another way again, [disconnect SSO](#disconnect-or-delete-the-connection). If your organization needs a specific sign-in method, such as email and password, contact [Ravenna support](mailto:support@ravenna.ai).
</Warning>

<Steps>
  <Step title="Turn on enforcement">
    On **Settings > SSO**, in **Enforce SSO-Only Authentication**, turn on the switch.
  </Step>

  <Step title="Confirm">
    Click **Disable Other Methods**. An **Enforced** badge appears next to the section title.
  </Step>
</Steps>

## Disconnect or delete the connection

<CardGroup cols={2}>
  <Card title="Disconnect" icon="unplug">
    Turns SSO off and keeps its configuration. Your organization goes back to Ravenna's default sign-in methods. Click **Connect** to turn it back on.
  </Card>

  <Card title="Delete" icon="trash-2">
    Removes the connection and its configuration. Other sign-in methods stay off.
  </Card>
</CardGroup>

<Warning>
  Deleting the connection doesn't turn other sign-in methods back on. Disconnect before you delete, or your users may have no way to sign in.
</Warning>

<Steps>
  <Step title="Open the connection menu">
    On **Settings > SSO**, click the **Connected** dropdown and select **Disconnect** or **Delete**.
  </Step>

  <Step title="Confirm">
    Type the connection name shown in the dialog, such as **Okta SSO**, then confirm.
  </Step>
</Steps>

## Monitor sign-in activity

Use your IdP's sign-in logs to see who signed in to Ravenna and why a sign-in failed, such as the System Log in Okta or the sign-in logs in Microsoft Entra ID.

<Info>
  Ravenna's [audit log](/documentation/platform/organizations/audit-log) doesn't record SSO sign-ins or changes to the SSO connection.
</Info>

<Callout icon="link" color="#6B7280">Learn more about [reviewing user access](/integrations/sso/user-management#review-user-access)</Callout>


## Related topics

- [User management](/integrations/sso/user-management.md)
- [Setup](/integrations/sso/setup.md)
- [Organization settings](/documentation/platform/organizations/settings.md)
- [Troubleshooting](/integrations/sso/troubleshooting.md)
- [Workflows](/integrations/microsoft-entra/workflows.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.