Merge branch 'master' into c-noonan-patch-1

Author: c-noonan

src/segment-app/iam/sso.md

@@ -2,15 +2,15 @@
 title: "Single Sign On team management"
 ---
 
-Segment supports Single Sign On for Business Tier accounts. You can use any SAML-based Identity Provider (IDP), for example Okta, Bitium, OneLogin, or Centrify, or use GSuite to serve as your identity provider, delegating access to the application based on rules you create in your central identity management solution.
+Segment supports Single Sign On for Business Tier accounts. You can use any SAML-based Identity Provider (IdP), for example Okta, Bitium, OneLogin, or Centrify, or use GSuite to serve as your identity provider, delegating access to the application based on rules you create in your central identity management solution.
 
-With SSO, you have centralized control over your users' ability to authenticate or not in your IDP, and can also enforce rules like two-factor authentication or password rotation at the IDP level.
+With SSO, you have centralized control over your users' ability to authenticate or not in your IdP, and can also enforce rules like two-factor authentication or password rotation at the IdP level.
 
-You can configure as many IDP connections to your workspace as needed to support IDP-initiated authentication. This allows seamless migration from one system to a new one, for example if your organization switches IDP vendors or switches from GSuite to a dedicated SAML IDP like Okta or OneLogin.
+You can configure as many IdP connections to your workspace as needed to support IdP-initiated authentication. This allows seamless migration from one system to a new one, for example if your organization switches IdP vendors or switches from GSuite to a dedicated SAML IdP like Okta or OneLogin.
 
 To enable SSO-based login from the Segment login page (app.segment.com/login), you must first verify that you own the domain, and connect it to your organization's Segment account. Once you have done that, SSO users from your domain can use the Segment login page to access your default Segment workspace.
 
-The Segment login page can only be connected to one workspace. To use your IDP with multiple workspaces, you will have to initiate login to the other workspaces from the IDP instead of through the login portal.
+The Segment login page can only be connected to one workspace. To use your IdP with multiple workspaces, you will have to initiate login to the other workspaces from the IdP instead of through the login portal.
 
 ## Set up — SAML
 
@@ -22,9 +22,11 @@ To get started, go to your workspace settings and choose the "Connections" tab u
 
 ![](images/asset_XCyMZpwo.png)
 
-## Prepare your IDP for the connection.
+## Prepare your IdP for the connection.
 
-To get started, you'll need to create an application in your IDP. We're in the process of rolling out officially supported apps with the most popular IDPs, but in the meantime you can create a custom SAML-based application.
+Segment officially supports apps for Okta, Azure AD, and OneLogin. Next, find Segment in your IdP's app catalog, and follow the set up instructions they provide. 
+
+If you're using a different IdP, you must create a custom SAML-based application.
 
 Your provider will ask you for a few things from Segment, which we provide in the set up flow:
 
@@ -34,37 +36,37 @@ Your provider will ask you for a few things from Segment, which we provide in th
 
 - For GSuite configurations, make sure the `Start URL` field in Service Provider Details is left blank.
 
-- Different IDPs have different names for the Audience URL. Some call it "Audience URI", some call it "Entity ID", some call it "Service Provider Entity ID." It's likely there are only two required fields without correct defaults, and they correspond to the `SSO URL` and `Audience URL` values above.
+- Different IdPs have different names for the Audience URL. Some call it "Audience URI", some call it "Entity ID", some call it "Service Provider Entity ID." It's likely there are only two required fields without correct defaults, and they correspond to the `SSO URL` and `Audience URL` values above.
 
-- In all IDPs we've worked with, the default `NameID` option is the correct one. Make sure it's using the `emailAddress` schema.
+- In all IdPs we've worked with, the default `NameID` option is the correct one. Make sure it's using the `emailAddress` schema.
 
-- In all IDPs we've worked with, the default connection encryption options are the correct ones. (Signed Response & Assertion Signature with SHA256, Unencrypted Assertions).
+- In all IdPs we've worked with, the default connection encryption options are the correct ones. (Signed Response & Assertion Signature with SHA256, Unencrypted Assertions).
 
-- Different IDPs store records of your employees differently. The only attribute mapping we require is to make sure you're sending `email` . In Okta this is at `user.email`. In Duo this is `mail`.
+- Different IdPs store records of your employees differently. The only attribute mapping we require is to make sure you're sending `email` . In Okta this is at `user.email`. In Duo this is `mail`.
 
-- Make sure you've enabled "send all attributes" (not just NameID) if applicable for your IDP.
+- Make sure you've enabled "send all attributes" (not just NameID) if applicable for your IdP.
 
 - No `RelayState` is required. This is also sometimes called `Target`.
 
-Once you create the application in your IDP, you can come back to Segment and click "Next".
+Once you create the application in your IdP, you can come back to Segment and click "Next".
 
-## Configure Segment to Talk to Your IDP.
+## Configure Segment to Talk to Your IdP.
 
-Your IDP provides a URL and x.509 certificate. Copy them into their respective fields in Segment.
+Your IdP provides a URL and x.509 certificate. Copy them into their respective fields in Segment.
 
 ![](images/asset_s19XDgWX.png)
 
 Then, click "Configure Connection."
 
 You're all set!
 
-## Test your connection with IDP-initiated SSO.
+## Test your connection with IdP-initiated SSO.
 
 Back at the connections page, make sure your connection is enabled with the switch on the right.
 
 ![](images/asset_SNxN4JhO.png)
 
-You can now test using IDP-initiated SSO (by clicking login to Segment from within your IDP) is working correctly. If not, double check the IDP configuration gotchas section above.
+You can now test using IdP-initiated SSO (by clicking login to Segment from within your IdP) is working correctly. If not, double check the IdP configuration gotchas section above.
 
 ## Set up — GSuite
 
@@ -91,17 +93,17 @@ Enter your domain and click "Add Domain." When you click verify, you're given tw
 
 ##### Do you support automatic user provisioning?
 
-Segment supports "just in time" user permissioning; new users who authenticate using your IDP are automatically created in Segment as minimal-access (read-only) members.
+Segment supports "just in time" user permissioning; new users who authenticate using your IdP are automatically created in Segment as minimal-access (read-only) members.
 
-If the user already exists in Segment then Segment associates the IDP-identity with the existing Segment user account.
+If the user already exists in Segment then Segment associates the IdP-identity with the existing Segment user account.
 
 ##### Do you support automatic user de-provisioning?
 
-No. However, since any non-owners must log in with SSO to access your workspace, once you remove their authorization in your IDP they will no longer be able to access your workspace.
+No. However, since any non-owners must log in with SSO to access your workspace, once you remove their authorization in your IdP they will no longer be able to access your workspace.
 
 ##### Will my users lose access to their other workspaces when I enable SSO?
 
-Segment allows users to own their own workspaces. While your IDP authentication will ensure that any non-owners must have logged in with SSO to access _your workspace_, they can still log into Segment with username and password to access their own workspaces.
+Segment allows users to own their own workspaces. While your IdP authentication will ensure that any non-owners must have logged in with SSO to access _your workspace_, they can still log into Segment with username and password to access their own workspaces.
 
 ##### Can I still invite people outside the organization?