--- title: "Set Up SSO with OneLogin" slug: "set-up-single-sign-on-to-onelogin" updated: 2026-09-29T18:23:42Z published: 2026-09-29T18:23:42Z canonical: "docs.redcanary.com/set-up-single-sign-on-to-onelogin" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Set Up SSO with OneLogin Enhance your organization's security and streamline user access by enabling single sign-on (SSO) with OneLogin. This article will walk you through the complete setup process, where you’ll configure settings in both OneLogin and Zscaler MDR. If you have questions or are new to SSO, see our [Overview of Single Sign-On](/doc/docs/overview-single-sign-on). ## 1 Zscaler MDR | Configure SSO Settings 1. In the Zscaler MDR portal, click your user profile in the top right corner. 2. Click **Single Sign-On**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminsso-1_01.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) 3. Enable the following settings: - **This SSO configuration should be active** This setting activates the SSO setup, after you complete the configuration and click **Save** at the bottom. - **Automatically create a Zscaler MDR user the first time a user is authenticated** This setting automatically provisions a Zscaler MDR account when a new user logs in with SSO. As an optional configuration, you can assign default roles to new users. Select one of the following roles to apply automatically: For a full description of each role's permissions, see [Understand and Assign Roles](/doc/docs/understand-and-assign-roles). To reset a user's permissions to the selected default every time they sign in, check the **Grant these roles on EVERY sign in** box. This will override any manual role changes made previously. This is useful for enforcing a "least privilege" baseline, where you can manually grant temporary high-level access that will be automatically revoked on the next login. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminsso-1_02.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) - Admin - Workflow User - Analyst - Analyst Viewer - Applications Manager - EDR User - Responder You’ll finish configuring these settings in a later step. ## 2 OneLogin | Create a Zscaler MDR App 1. Log in to your [OneLogin portal](https://app.onelogin.com/login). 2. Go to the **Applications** tab and click **Add App**. 3. Search for and select **SAML Test Connector (IdP)**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-2_01.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) 4. In the **Display Name** field, enter “Zscaler MDR”. 5. Click Save. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-2_02.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) ## 3 OneLogin / Zscaler MDR | Configure SSO Settings 1. Return to your OneLogin portal where you created the Zscaler MDR app. 2. In the left-hand menu, click the **Configuration** tab. 3. Navigate back to the Zscaler MDR SSO settings page and copy the **Entity / Issuer** value, then paste it in the OneLogin **Audience** field. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_01.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_02.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) 4. In the OneLogin fields below, enter your Assertion Consumer Service (ACS) URL: > [!NOTE] > Note > > Remember to replace `mysubdomain` with your actual subdomain. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_03.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) - **Recipient**: `https://mysubdomain.my.redcanary.co/saml_sp/consume` - **ACS (Consumer) URL Validator**: `https://mysubdomain.my.redcanary.co/saml_sp/consume` - **ACS (Consumer) URL**:`https://mysubdomain.my.redcanary.co/saml_sp/consume` 5. In the left-hand menu, click the **Parameters** tab and create a new parameter: ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_04.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) - In the **Field name**, enter “Email” - Check the **Include in SAML assertion** box - Click **Save** - In the **Value** dropdown, select **Email** - Click **Save** 6. Click **Save** to save all changes so far. 7. In the **SSO** tab, under the X.509 Certificate, click **View Details**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_05.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) 8. Copy the certificate. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_06.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) 9. On the Zscaler MDR SSO settings page, paste the certificate in the **Identity Provider X508 Cert** field. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_07.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) 10. Copy and paste the following values from OneLogin to Zscaler MDR: - Copy the OneLogin Issuer URL and paste to Zscaler MDR **Identity Provider Entity ID** - Copy the OneLogin SAML 2.0 Endpoint (HTTP) and paste to Zscaler MDR **Identity Provider SSO Target URL** - Copy the OneLogin SLO Endpoint (HTTP) and paste to Zscaler MDR **Identity Provider SLO Target URL** ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_08.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) 11. In OneLogin, click **Save.** 12. In Zscaler MDR, in the **Email Attribute** field, enter “email.” ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-3_09.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D) 13. In Zscaler MDR, click **Save** to activate the SSO configuration. ## 4 Zscaler MDR | Require SSO for User Login Once you’ve successfully tested your SSO setup, go to the Zscaler MDR SSO settings page and check the box **Disable user / password login and require login via Single Sign On**. This will force SSO login for all user logins. Make sure to click **Save** to apply the change. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoonelogin-4_01.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A36%3A35Z&se=2026-11-03T14%3A36%3A35Z&sr=c&sp=r&sig=3Y4aTFr4xOZihpjgSmaNuwjid%2Bem%2BLtIPLUb33v1KRs%3D)