## Summary
Documentation-only update to the SSO deployment guide
(`docs/Deploy/single-sign-on-sso.md`) to improve clarity and consistency
across the supported identity providers. No code changes.
## Changes
- **Okta**: Rewrote the setup section into clear numbered steps — app
naming/logo, SAML settings, attribute statements (including the
`displayname` expression and JIT group-to-role mapping example), and
copying the
metadata URL.
- **Consistent callback URLs**: Standardized how each IdP documents the
two callback URLs, making the distinction explicit everywhere:
- **Fleet users** → `https://<your_fleet_url>/api/v1/fleet/sso/callback`
- **End users** (MDM/end user authentication) →
`https://<your_fleet_url>/api/v1/fleet/mdm/sso/callback`
- **Google Workspace, Entra, authentik, Other IdPs**: Updated each to
use the same "depends on which connection you're configuring" callback
URL pattern, and aligned Entity ID wording.
- Cleaned up formatting/indentation and removed redundant/duplicated
instructions.
- Added a new screenshot: `docs/images/okta-sso-step-1.png`.
## Checklist for submitter
- [x] QA'd all new/changed functionality manually (previewed rendered
Markdown and images)
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
