> ## Documentation Index
> Fetch the complete documentation index at: https://labs.laer.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Authentication
Epiq AI Admin permissions are required to enforce two-factor authentication across your organization account.
## Set up MFA
When you enable two-factor authentication, users are required to use 2FA to access projects.
Users will be prompted to set up MFA during login. A one-time password (OTP) will be sent to a user by email. Users can also get verified through an authentication app.
Once MFA is enabled for a user, the user will see the following screen for MFA setup. Scan the QR code through the authentication app and enter the OTP token for verification.
After this initial verification, users can use either the authentication app or Email to get the MFA token in the subsequent logins.
## Set up Azure Active Directory SSO
Admins can set up Azure Active Directory single sign-on (SSO) on Aida.
1. Log in to the [Azure portal](https://portal.azure.com/).
2. Go to the **Enterprise Applications** page.
3. Click `+ New application`
4. Click `+ Create your own application`.
5. Once the application is created, click on "1. Assign users and groups", then "+ Add user". Add yourself and the group you've created to the Aida app. Click "Assign".
6. Navigate back to **Overview**, click on "2. Set up single sign-on" and then select SAML as your single sign-on method.
7. For Section (1), labeled "Basic SAML Configuration", enter the following data in each line and save your changes.
* Identifier (Entity ID): `https://aida.yourcompany.com`
* Reply URL (Assertion Consumer Service URL): `https://aida.yourcompany.com/api/v1/saml/YOUR_ACCOUNT_ID/acs`
* Sign on URL: `https://aida.yourcompany.com/api/v1/saml/YOUR_ACCOUNT_ID/login`
* Relay State: `https://aida.yourcompany.com`
* Logout URL: `https://aida.yourcompany.com/api/v1/saml/YOUR_ACCOUNT_ID/logout`
8. In Section (3), labeled "SAML Certificate", download the "Federation Metadata XML".
9. Navigate to your **Admin Settings > SSO** (or go to `https://aida.yourcompany.com/admin/sso/`).
10. Upload the App Federation Metadata XML from above under "Federation Metadata XML".
6. You can then log in Aida through the "Sign in with SSO" option.
## Set up Okta
Admins can set up Okta SAML application single sign-on (SSO) on Aida.
1. Log in to the [Okta Dashboard](https://developer.okta.com/).
2. Go to the **Applications** page.
3. Click `Create App Integration` and select `SAML 2.0`
4. Setup your own Application.
5. Enter the following data in each line and save your changes.
* Single sign-on URL: `https://aida.yourcompany.com/api/v1/saml/YOUR_ACCOUNT_ID/acs`
* Audience URI (SP Entity ID): `https://aida.yourcompany.com`
* Relay State: Leave it empty
6. Add an Attribute Statement:
* Name: /claims/name
* Name format: Unspecified
* Value: user.email
7. Export the metadata in XML and upload it to the SSO settings in AIDA under "Federation Metadata XML".
8. Support SSO through multiple domains
Add a second SSO URL in the section below
`https:///api/v1/saml//acs`
