> ## Documentation Index
> Fetch the complete documentation index at: https://learn.social.plus/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started

> Access and manage your applications, and organization settings through the unified portal

Admin Portal provides three different sign-in options to cater to your organization's needs and preferences. These options are designed to provide convenience and security for users accessing the portal. Access the sign-in page at the Admin Portal.

<Info>
  Access the unified Portal to manage applications, organization configuration, and secure administrator access. This guide covers current sign‑in methods (Email & SAML SSO), rollout, and operational best practices. Google sign-in has been deprecated (@gmail domain).
</Info>

<Warning>Google sign-in (@gmail domain) has been deprecated and is no longer available. Migrate any residual flows to SAML SSO or Email + Password.</Warning>

<CardGroup cols={3}>
  <Card title="Email Login" icon="at">Baseline credential access</Card>
  <Card title="SAML SSO" icon="shield">Centralized identity & governance</Card>
  <Card title="Provision" icon="user-plus">Auto user creation via SSO</Card>
  <Card title="Migrate" icon="arrows-left-right">Link legacy accounts</Card>
  <Card title="Audit" icon="clock">Track access changes</Card>
  <Card title="Resilience" icon="dumbbell">Maintain break‑glass account</Card>
</CardGroup>

## Sign-In Options

<Tabs>
  <Tab title="Email & Password">Direct portal credentials (use for initial access or controlled break‑glass fallback).</Tab>
  <Tab title="SAML SSO">Enterprise IdP handles authentication; users provisioned automatically on first assertion.</Tab>
</Tabs>

## SSO (SAML) Enablement Workflow

<Steps>
  <Step title="Engage Support">Contact support with org domain & desired scope (all users or whitelist subset).</Step>
  <Step title="Configure IdP">Set Assertion Consumer (Response) URL: [https://amity-portal-prod-auth.amity.co/saml2/idpresponse](https://amity-portal-prod-auth.amity.co/saml2/idpresponse)</Step>
  <Step title="Audience Restriction">urn:amazon:cognito:sp:eu-central-1\_gcJoCA15K</Step>
  <Step title="Attribute Mapping">Map email → [http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress)</Step>
  <Step title="Domain Sign-In">Users choose “Sign in with SSO”, enter org domain, redirected to IdP.</Step>
  <Step title="User Migration">Existing portal accounts linked to SSO identities post first successful SAML assertion.</Step>
</Steps>

<Warning>Delete legacy direct admin accounts before activation if you want to strictly enforce SSO-only access.</Warning>

## Post-SSO Behavior

<AccordionGroup>
  <Accordion title="Automatic Provisioning">New SSO-authenticated users are created with default access model on first login.</Accordion>
  <Accordion title="Console User Creation Disabled">Manual creation in Console is restricted to prevent identity fragmentation.</Accordion>
  <Accordion title="Legacy Accounts">Existing non-SSO accounts remain functional unless explicitly removed.</Accordion>
  <Accordion title="Security Consolidation">Central revocation at IdP immediately prevents portal access.</Accordion>
</AccordionGroup>

## Migration Tips

<Tabs>
  <Tab title="Before Enablement">Inventory current admin users; decide which persist; communicate cutover date.</Tab>
  <Tab title="During Cutover">Enable SSO in low-traffic window; monitor first login success rate.</Tab>
  <Tab title="After Enablement">Remove unused credential accounts; audit access logs; refine group mapping.</Tab>
</Tabs>

## Metrics & Monitoring

| Metric                 | Purpose                           | Healthy Signal | Action Trigger                          |
| ---------------------- | --------------------------------- | -------------- | --------------------------------------- |
| First Login Success %  | Onboarding friction               | ≥ 95%          | Drop → review IdP attribute mapping     |
| Legacy Account Count   | Progress toward full SSO adoption | Trending to 0  | Flat > 0 for 2 cycles → enforce cleanup |
| SSO Provision Time     | Automation latency                | \< 30s         | Delays → check webhook / IdP latency    |
| Failed SAML Assertions | Detect config issues              | Near 0         | Spike → validate Audience / ACS URL     |
| Duplicate Emails       | Identity collision                | 0              | Any → merge / remove stale account      |

## Troubleshooting

| Issue                        | Likely Cause                 | Resolution                                        |
| ---------------------------- | ---------------------------- | ------------------------------------------------- |
| SSO option not shown         | Org not enabled              | Confirm enablement with support                   |
| Assertion Consumer mismatch  | Wrong ACS URL                | Update IdP to official URL                        |
| Audience validation error    | Incorrect Audience string    | Use urn:amazon:cognito:sp:eu-central-1\_gcJoCA15K |
| User loops back to login     | Attribute (email) not mapped | Map email claim correctly                         |
| Duplicate account created    | Case variation in email      | Normalize email casing & merge                    |
| Cannot remove legacy account | Still active sessions        | Terminate sessions then delete                    |

## Best Practices

<AccordionGroup>
  <Accordion title="Least Privilege">Leverage IdP groups to scope admin roles (avoid broad default grants).</Accordion>
  <Accordion title="Periodic Review">Quarterly audit of active SSO users vs HR roster.</Accordion>
  <Accordion title="Break-Glass Access">Maintain one monitored credential account for emergency (rotate often).</Accordion>
  <Accordion title="Communication Plan">Notify administrators of SSO switch ahead of time with clear rollback steps.</Accordion>
  <Accordion title="Logging & Alerting">Integrate portal login events into SIEM for anomaly detection.</Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="Admin Access Control" icon="users" href="../console/management/admin-access-control">Roles & permissions</Card>
  <Card title="Security" icon="lock" href="../console/settings/security">Secure Mode & keys</Card>
</CardGroup>

<Info>If you need assistance validating your SAML metadata, contact support with the IdP entityID and certificate fingerprint.</Info>