diff --git a/docs/Deploy/single-sign-on-sso.md b/docs/Deploy/single-sign-on-sso.md
index 9a0d3571cc..084b8ce52a 100644
--- a/docs/Deploy/single-sign-on-sso.md
+++ b/docs/Deploy/single-sign-on-sso.md
@@ -15,11 +15,9 @@ Create a new SAML app in Okta:
 
 If you're configuring [end user authentication](https://fleetdm.com/guides/setup-experience#end-user-authentication), use `https://<your_fleet_url>/api/v1/fleet/mdm/sso/callback` for the **Single sign on URL** instead.
 
-Once configured, you will need to retrieve the issuer URI from **View Setup Instructions** and metadata URL from the **Identity Provider metadata** link within the application **Sign on** settings. See below for where to find them:
-
 > Note that while setting up the SAML app in Okta, the Entity ID is called "Audience URI (SP Entity ID)", but after the app is set up, Okta labels this as "Audience Restriction".
 
-![Where to find SSO links for Fleet](https://raw.githubusercontent.com/fleetdm/fleet/main/docs/images/okta-retrieve-links.png)
+Once configured, you will need to retrieve the Identity Provider metadata URL either from **View Setup Instructions** from the **Identity Provider metadata** link within the application **Sign on** settings, or under the **SAML 2.0** section under **Metadata details**.
 
 > The Provider Sign-on URL within **View Setup Instructions** has a similar format as the Provider SAML Metadata URL, but this link provides a redirect to _sign into_ the application, not the metadata necessary for dynamic configuration.
 
diff --git a/docs/images/okta-retrieve-links.png b/docs/images/okta-retrieve-links.png
deleted file mode 100644
index 29f5291e1c..0000000000
Binary files a/docs/images/okta-retrieve-links.png and /dev/null differ
diff --git a/frontend/pages/admin/IntegrationsPage/cards/IdentityProviders/components/EndUserAuthSection/EndUserAuthSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/IdentityProviders/components/EndUserAuthSection/EndUserAuthSection.tsx
index 437c5b31e7..2096e324ad 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/IdentityProviders/components/EndUserAuthSection/EndUserAuthSection.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/IdentityProviders/components/EndUserAuthSection/EndUserAuthSection.tsx
@@ -170,7 +170,7 @@ const EndUserAuthSection = ({
             value={formData.entity_id}
             parseTarget
             error={formErrors?.entity_id}
-            tooltip="The required entity ID is a URI that you use to identify Fleet when configuring the identity provider."
+            tooltip="The Entity ID is a required URI that you use to identify Fleet when configuring the identity provider. Okta calls this Audience Restriction."
           />
           <InputField
             label="Metadata URL"
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Sso/Sso.tsx b/frontend/pages/admin/IntegrationsPage/cards/Sso/Sso.tsx
index 38dd26e3bc..ad5ba12138 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/Sso/Sso.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/Sso/Sso.tsx
@@ -237,14 +237,14 @@ const Sso = ({
           />
           <InputField
             label="Entity ID"
-            helpText="The URI you provide here must exactly match the Entity ID field used in identity provider configuration."
+            helpText="The URI you provide here must exactly match the Entity ID field used in the identity provider configuration."
             onChange={onInputChange}
             name="entityId"
             value={entityId}
             parseTarget
             onBlur={onInputBlur}
             error={formErrors.entity_id}
-            tooltip="The required entity ID is a URI that you use to identify Fleet when configuring the identity provider."
+            tooltip="The Entity ID is a required URI that you use to identify Fleet when configuring the identity provider. Okta calls this Audience Restriction."
           />
           <InputField
             label="IdP image URL"