---
title: "Create or update the org identity provider: `preset: entra` = one click on the connected Microsoft 365 tenant, `preset: google_workspace` = one click on the connected Google Workspace (only accounts of its verified domains sign in) — nothing else needed; `oidc` / `saml` = the free-form fields (the OIDC secret is never stored)"
method: PUT
path: "/api/orgs/{orgId}/sso"
tags: ["sso"]
---

# Create or update the org identity provider: \`preset: entra\` = one click on the connected Microsoft 365 tenant, \`preset: google_workspace\` = one click on the connected Google Workspace (only accounts of its verified domains sign in) — nothing else needed; \`oidc\` / \`saml\` = the free-form fields (the OIDC secret is never stored)

`PUT /api/orgs/{orgId}/sso`

## Request

- Base URL: `https://api.wizbi.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.wizbi.ai/api/orgs/{orgId}/sso`
- Auth: none declared

## Path parameters

- `orgId` string, required

## Request body

- object
  - `preset` 'entra' | 'google_workspace' | 'oidc' | 'saml'
  - `protocol` 'saml' | 'oidc'
  - `enabled` boolean
  - `saml` object
    - `idpEntityId` string, required
    - `ssoUrl` string, uri, required
    - `certificates` string[], required
  - `oidc` object
    - `issuer` string, uri, required
    - `clientId` string, required
    - `clientSecret` string
  - `required` boolean
  - `jit` object
    - `enabled` boolean
    - `role` 'org_admin' | 'member'
    - `groupIds` string[]

## Response `200`

OK.

- SsoView
  - `config` object, nullable, required
    - `orgId` string, required
    - `enabled` boolean
    - `protocol` 'saml' | 'oidc'
    - `providerId` string
    - `preset` 'entra' | 'google_workspace' | 'oidc' | 'saml'
    - `entra` object
      - `tid` string, required
    - `googleWorkspace` object
      - `customerId` string, required
      - `primaryDomain` string
    - `saml` object
      - `idpEntityId` string, required
      - `ssoUrl` string, uri, required
      - `certificates` string[], required
    - `oidc` object
      - `issuer` string, uri, required
      - `clientId` string, required
      - `hasSecret` boolean
    - `required` boolean
    - `jit` object
      - `enabled` boolean
      - `role` 'org_admin' | 'member'
      - `groupIds` string[]
    - `domains` object[]
      - `domain` string, required
      - `token` string, required
      - `verified` boolean
      - `verifiedAt` string, date-time
      - `verifiedBy` string
      - `verifiedVia` 'dns' | 'super_admin' | 'microsoft_tenant' | 'google_workspace'
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `updatedBy` string
  - `serviceProvider` object, required
    - `entityId` string, required
    - `acsUrl` string, required
    - `redirectUri` string, required
  - `available` boolean, required
  - `status` 'connected' | 'attention' | 'available', required
  - `attentionReason` 'microsoft_disconnected' | 'google_workspace_disconnected' | 'no_verified_domains' | 'disabled'
  - `scim` object, required
    - `available` boolean, required
    - `enabled` boolean, required
    - `baseUrl` string, required
    - `prefix` string
    - `createdAt` string
    - `lastUsedAt` string

## Other responses

- `400`: Invalid configuration.
- `403`: Insufficient role.
- `503`: SSO is not configured on this deployment.

---

[API](https://skmtc.dev/wizbi/apis/wizbi-core-api.md) · [All operations](https://skmtc.dev/wizbi/apis/wizbi-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wizbi/apis/wizbi-core-api/revisions/5a47416c82ec?raw)