# The SSO enrollment wizard

Connecting your identity provider is eight steps, and the wizard will not let you activate
something that has not been proven to work.

## The steps

1. **Provider** — Google Workspace, Microsoft Entra ID, generic OIDC, or generic SAML.
   (Password + MFA is shown for reference; Sentilai itself is passkey-only.)
2. **Overview** — what this provider needs, which permissions you need in it, and a
   realistic time estimate: 10 minutes for Google, 15 for Entra and generic OIDC, 20 for
   SAML.
3. **Configure** — the credentials. See [Configure your identity provider](/books/team-management-and-sso/page/configure-your-identity-provider).
4. **Validate** — Sentilai fetches your provider's discovery document or metadata and runs
   a checklist. **You cannot continue until it passes**, because every failure here would
   otherwise become a mysterious login error later.
5. **Test login** — a real login, in a popup, against your real provider. It reports the
   email it got back, or the error.
6. **Provisioning** — what happens to people who sign in. See [Provisioning and approval](/books/team-management-and-sso/page/provisioning-and-approval).
7. **Review** — a read-back of everything, including whether a secret is stored.
8. **Activate** — switch it on.

## You must test before you activate

Activating without a successful test login is refused, with a message telling you to run
the test first. This is not bureaucracy: an SSO configuration that looks right and does
not work locks out everyone who depends on it, and the person best placed to notice is you,
one minute earlier.

## Afterwards

The landing view shows the provider, its status — Draft, Testing, Active or Failing — and
a **configuration quality score** out of five with specific recommendations. It is worth
reading once; it tends to catch the things that work today and cause trouble later.

You can **Edit configuration**, **Deactivate**, or **Remove**. Removing it means anyone
who signs in this way can no longer do so, and the confirmation says exactly that.