# Ensure Identity Federation (SSO) Is Configured

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826024824884-ensure-identity-federation-sso-is-configured
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the OVHcloud account is connected to the organization's identity provider (for example Microsoft Entra ID, Okta, AD FS, or Google Workspace) through SAML single sign-on, so that users sign in with their company account and access is controlled centrally.

**Rationale**

With SSO, the company identity provider controls who can sign in, applies its MFA and access rules, and removes access as soon as a user is disabled. Without it, each person needs a separate OVHcloud login that must be managed by hand, so former staff may keep access.

**Impact**

-   Users sign in with their company account
    
-   Access is removed centrally when a user leaves
    
-   Groups in the identity provider must be mapped to OVHcloud groups
    

**Default Value**

By default, no SSO connection is configured.

**Pre-Requisites**

-   Access to the OVHcloud account owner login
    
-   Administrator access to the identity provider
    
-   The identity provider's SAML metadata
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Under Identity and Access Management, select Identities.
    
4.  Check whether an SSO connection is configured.
    
5.  If no SSO connection exists, follow the implementation steps.
    

**Implementation Steps**

1.  In your identity provider, create a SAML application for OVHcloud and download its metadata.
    
2.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
3.  In the left-hand menu, select Identity, Security & Operations.
    
4.  Under Identity and Access Management, select Identities.
    
5.  Select the option to set up an SSO connection, paste the identity provider metadata, and enter the Group attribute name.
    
6.  Choose whether to keep local OVHcloud users active (tick Keep active OVHcloud users if needed).
    
7.  Add the identity provider groups to OVHcloud and grant them access through IAM policies.
    
8.  Sign in with SSO to confirm it works.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Under Identity and Access Management, select Identities.
    
4.  Remove the SSO connection. Make sure the owner login or a local user can still sign in first.
    

**Reference**

-   [https://support.us.ovhcloud.com/hc/en-us/articles/16487373887763-Enabling-Entra-ID-SSO-connections-with-your-OVHcloud-account](https://support.us.ovhcloud.com/hc/en-us/articles/16487373887763-Enabling-Entra-ID-SSO-connections-with-your-OVHcloud-account)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.