> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mention-me.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Updating Your SSO Connection

> How to move an existing Okta, Auth0, Google Workspace, Microsoft Entra, or other OIDC provider's SSO connection to the new Mention Me application.

If your organisation already has SSO configured, an administrator can use the guided update journey on the **Security & Data** page instead of the SSO settings form. This is for organisations already on SSO. If you are setting up SSO for the first time, see [Single Sign-On (SSO) Setup](/knowledge/security/account/sso-setup) instead.

Mention Me needs a new application in your identity provider. Your existing app is tied to old callback URLs and cannot be reused, even if the provider is the same.

<Warning>
  Do not reuse your existing Mention Me application, client ID, or secret.
  Create a new one using the instructions below.
</Warning>

<Tabs>
  <Tab title="Okta">
    ## Create the Connection

    On **Security & Data**, follow the on-screen step to create the new connection. Mention Me gives you an **ACS URL** and an **Entity ID** to use below.

    ## Okta Setup

    <Steps>
      <Step title="Open the Okta Admin portal">
        Go to **Applications**, then **Create App Integration**.
      </Step>

      <Step title="Choose SAML 2.0">
        Select **SAML 2.0** as the sign-in method.
      </Step>

      <Step title="Set the ACS URL">
        Paste the ACS URL from Mention Me into **Single sign-on URL**.
      </Step>

      <Step title="Set the entity ID">
        Paste the entity ID from Mention Me into **Audience URI (SP Entity ID)**.
      </Step>

      <Step title="Add attribute statements">
        Add: `mail` = `user.profile.email`, `firstName` = `user.profile.firstName`,
        `lastName` = `user.profile.lastName`.
      </Step>

      <Step title="Assign the app">
        On the **Assignments** tab, assign the app to yourself and anyone else who
        will test sign-in.
      </Step>

      <Step title="Download the IdP metadata">
        On the **Sign On** tab, download the **Identity Provider metadata** file.
      </Step>
    </Steps>

    ## Mention Me Setup

    Upload the metadata file on **Security & Data**. Once it is saved, you can test the connection (see [Testing Your New Connection](#testing-your-new-connection) below).
  </Tab>

  <Tab title="Google Workspace">
    ## Create the Connection

    On **Security & Data**, follow the on-screen step to create the new connection. Mention Me gives you an **ACS URL** and an **Entity ID** to use below.

    ## Google Setup

    <Steps>
      <Step title="Open the Google Admin console">
        Go to **Apps > Web and mobile apps > Add app > Add custom SAML app**.
      </Step>

      <Step title="Set the ACS URL and entity ID">
        Paste the ACS URL from Mention Me into **ACS URL**, and the entity ID into
        **Entity ID**.
      </Step>

      <Step title="Add attribute mapping">
        Map **Primary email** to `email`, **First name** to `firstName`, and **Last
        name** to `lastName`.
      </Step>

      <Step title="Set the Name ID">
        Set **Name ID format** to `EMAIL` and **Name ID** to **Primary email**.
      </Step>

      <Step title="Turn on user access">
        Turn **User access** on for yourself or everyone. Leaving it off for
        everyone causes Google to return `app_not_configured_for_user` at sign-in.
      </Step>

      <Step title="Download the IdP metadata">
        Download the **Identity Provider metadata** XML file.
      </Step>
    </Steps>

    <Warning>
      If you already created the app before reading this, check the ACS URL and
      Entity ID still match the values on Mention Me - they change if you start the
      connection again.
    </Warning>

    ## Mention Me Setup

    Upload the metadata file on **Security & Data**. Once it is saved, you can test the connection (see [Testing Your New Connection](#testing-your-new-connection) below).
  </Tab>

  <Tab title="Microsoft Entra">
    ## Create the Connection

    On **Security & Data**, follow the on-screen step to create the new connection. Mention Me gives you an **ACS URL** and an **Entity ID** to use below.

    ## Entra Setup

    <Steps>
      <Step title="Open the Microsoft Entra admin centre">
        Go to **Enterprise applications > New application > Create your own
        application**.
      </Step>

      <Step title="Choose non-gallery">
        Choose **Integrate any other application you don't find in the gallery
        (Non-gallery)**, and give it a new name. Do not reuse your existing Mention
        Me application.
      </Step>

      <Step title="Set up SAML">Choose **Set up single sign-on with SAML**.</Step>

      <Step title="Set the ACS URL">
        Paste the ACS URL from Mention Me into **Reply URL (Assertion Consumer
        Service URL)**.
      </Step>

      <Step title="Set the entity ID">
        Paste the entity ID from Mention Me into **Identifier (Entity ID)**.
      </Step>

      <Step title="Add attribute mapping">
        Map `email`, `firstName`, and `lastName` to the user's email, given name,
        and surname.
      </Step>

      <Step title="Download the federation metadata">
        Download the **Federation Metadata** XML file.
      </Step>
    </Steps>

    <Warning>
      If the application's Single sign-on page says "OIDC-based Sign-on" instead of
      offering SAML, you're on the wrong application - go back and create a new one
      following the non-gallery step above.
    </Warning>

    <Warning>
      If you already created the application before reading this, check the Reply
      URL and Identifier still match the values on Mention Me - they change if you
      start the connection again.
    </Warning>

    ## Mention Me Setup

    Upload the metadata file on **Security & Data**. Once it is saved, you can test the connection (see [Testing Your New Connection](#testing-your-new-connection) below).
  </Tab>

  <Tab title="Auth0">
    ## Create the Connection

    On **Security & Data**, follow the on-screen step to create the new connection. Mention Me gives you a **redirect URI** to use below.

    ## Auth0 Setup

    <Steps>
      <Step title="Open the Auth0 Dashboard">
        Create a new **Regular Web Application**.
      </Step>

      <Step title="Add the redirect URI">
        Add the redirect URI from Mention Me to **Allowed Callback URLs**.
      </Step>

      <Step title="Copy your credentials">
        Copy the new **Client ID** and **Client Secret**. Do not reuse the ones from
        your existing Mention Me app.
      </Step>
    </Steps>

    ## Mention Me Setup

    Enter the client ID and secret on **Security & Data**. Once they are saved, you can test the connection (see [Testing Your New Connection](#testing-your-new-connection) below).
  </Tab>

  <Tab title="Other OIDC Providers">
    ## Create the Connection

    On **Security & Data**, follow the on-screen step to create the new connection. Mention Me gives you a **redirect URI** to use below.

    ## Provider Setup

    <Steps>
      <Step title="Create an OIDC application">
        Use the authorisation code grant.
      </Step>

      <Step title="Register the redirect URI">
        Add the redirect URI from Mention Me as the callback URL.
      </Step>

      <Step title="Copy your credentials">
        Copy the new **Client ID** and **Client Secret**. Do not reuse the ones from
        your existing Mention Me app.
      </Step>
    </Steps>

    ## Mention Me Setup

    Enter the client ID and secret on **Security & Data**. Once they are saved, you can test the connection (see [Testing Your New Connection](#testing-your-new-connection) below).
  </Tab>
</Tabs>

## Testing Your New Connection

Once your provider details are saved, copy the test link from **Security & Data** and open it to sign in with a few accounts using the new connection. This signs in to Mention Me. Mention Me Classic keeps using your previous SSO app throughout, so testing carries no risk to your current logins.

<Info>
  **This finishes in Mention Me.** After a successful sign-in, an administrator
  sees a prompt on Mention Me with **Keep testing** or **Switch Classic to the
  new connection**. Signing in on its own does not switch anything - only
  confirming that prompt makes Mention Me Classic use the new connection too.
</Info>

<Warning>
  If your provider requires users or groups to be assigned to an application
  before they can sign in (for example Okta), assign the new application to
  everyone who needs access, not just the accounts used for testing, before
  confirming the switch. Anyone left unassigned will be unable to sign in once
  Classic moves over. Providers without this step (for example Google, which
  uses its own User access controls, or Auth0 and other generic OIDC providers)
  should check access is correct in their own provider instead.
</Warning>

## Rolling Back

There is no self-serve rollback. If you need to revert to your previous SSO connection after confirming the switch, [contact support](https://help.mention-me.com/hc/en-gb/requests/new).