---
updatedAt: 2026-10-01T18:04:12.000Z
---
# Import metadata to configure IdP | Pathfinder
Use the import metadata feature to import metadata directly from your IdP (via an exported file), streamlining the setup process and reducing the potential for errors.
### Important information
- Creating the initial setup without adding a domain (_domainless IdP_) allows you to test the configuration using a local account. After successful testing, add the domain to the Pathfinder IdP configuration page to enforce SAML authentication with your organization's email domain.
- Local login provides a way to test configuration when there is a domainless IdP.
## Microsoft Entra ID
Log on to Pathfinder and Microsoft Entra ID. Work through the configuration with the applications open side-by-side.
1. Create an application in Entra ID.
1. Enter a name for the app and use the default settings.
2. Entra ID displays **Getting Started** steps.
3. Assign users and groups. This configuration is different for every customer.
4. Go to **Single Sign on** and select **SAML**.
5. For now, enter ACS URL as and Entity ID as (these are temporary; you’ll update these settings later).
6. Click the **Federation Metadata XML** link to download the file.
2. Create an IdP for Entra ID in Pathfinder.
1. Sign into **login.beyondtrust.io**.
The **BeyondTrust Home** page displays.
2. At the top right of the page, click your site name to display a drop-down menu.
3. Select **Administration**.
The **BeyondTrust Pathfinder Administration** page opens and displays each available site as a tile.
4. From the ≡ menu, select **Identity & Authentication Providers**.
5. Click **Add Identity Provider**.
6. Add a name for the provider.
7. Click the box to upload the metadata file downloaded from Entra ID. This imports the configuration needed to set up Entra ID as your IdP. By default, the import tool sets the ACS URL and Service Provider Entity ID to the same value when you import.
6. Click **Add Identity Provider**.
The **SAML Configuration** dialog box displays.
7. Click **Copy to Clipboard**.
3. Go back to Entra ID.
1. Replace the placeholder values for ACS URL and Entity ID. Completing this step establishes the link between the Service Provider and the IdP for SAML.
4. Test and finalize configuration.
1. In Pathfinder, edit the Identity provider settings, leave the **Domain Name** box blank to test without email service domain binding.
2. Log on to Pathfinder via Entra ID. Pathfinder detects a domainless IdP.
3. Select **Entra ID** and click **Next**.
4. After successful login, update the domain setting in Pathfinder to the actual email domain.
5. Click **Save Changes**.
6. Log on again after adding the domain name to ensure you can successfully log on to Pathfinder via Entra ID.
After configuring your identity provider, you can edit it to select a PII region. The PII region allows you to select a region to store the personally identifiable information (PII) authentication data of users who are created by authenticating through this identity provider.
An identity provider region affects users only on first sign-in. If a user has already authenticated through the provider, and the provider's region is changed later, that user's PII authentication data is not automatically migrated.
If an identity provider's region is not set, those users are placed in the default US region, not in your organization region, even if your organization region is elsewhere.
For more information about data residency regions, see [Organization settings](https://docs.beyondtrust.com/bt-docs/docs/organization-settings#how-regional-data-residency-works)​.
## Okta
Log on to Pathfinder and Okta. Work through the configuration with the applications open side-by-side.
1. Create a SAML application in Okta.
1. In the Admin Console, select **Applications > Create App Integration**.
2. Select SAML 2.0.
3. Configure general settings.
4. For now, enter ACS URL as and Entity ID as (these are temporary; you’ll update these settings later).
5. Select **EmailAddress** as the **Name ID format**.
6. Expand **Advanced Settings**.
7. Set **Honor Force Authentication** to **Yes**.
8. Click **Next**.
9. Enter **groups** in the Name field under **Group Attribute Statements** section and define a filter if desired. The groups submitted in the assertion will determine the RBAC access of a user within each BeyondTrust app.
10. Click **Next**.
11. For **App type**, select **This is an internal app that we have created**.
12. Click **Finish**.
13. Click **View SAML setup instructions**.
14. Scroll to the IDP metadata and save the text as an XML file.
2. Create an IdP for Okta in Pathfinder.
1. Sign into **login.beyondtrust.io**.
The **BeyondTrust Home** page displays.
2. At the top right of the page, click your site name to display a drop-down menu.
3. Select **Administration**.
The **BeyondTrust Pathfinder Administration** page opens and displays each available site as a tile.
4. From the ≡ menu, select **Identity & Authentication Providers**.
5. Click **Add Identity Provider**.
6. Add a name for the provider.
7. Click the box to upload the metadata file downloaded from Okta. This imports the configuration needed to set up Okta as your IdP.
8. Click **Add Identity Provider**.
The **SAML Configuration** dialog box displays.
9. Click **Copy to Clipboard**.
3. Go back to Okta SAML config.
1. Go to **SAML Settings** and click **Edit**.
2. Click **Configure SAML**.
3. Replace the placeholder values for single sign on URL and Entity ID with the URL with the URL copied above. Completing this step establishes the link between the Service Provider and the IdP for SAML. Copy the metadata from Pathfinder to the **Single sign-on URL** and the **Recipient URL** (Entity ID) fields.
4. Test and finalize configuration.
1. In the Identity provider settings, leave the **Domain Name** box blank to test without email service domain binding.
2. Log on to Pathfinder via Okta. Pathfinder detects a domainless IdP.
3. Select **Okta** and click **Next**.
4. After successful login, update the domain setting in Pathfinder to the actual email domain.
5. Click **Save Changes**.
6. Log on again after adding the domain name to ensure you can successfully log on to Pathfinder via Okta.
After configuring your identity provider, you can edit it to select a PII region. The PII region allows you to select a region to store the personally identifiable information (PII) authentication data of users who are created by authenticating through this identity provider.
An identity provider region affects users only on first sign-in. If a user has already authenticated through the provider, and the provider's region is changed later, that user's PII authentication data is not automatically migrated.
If an identity provider's region is not set, those users are placed in the default US region, not in your organization region, even if your organization region is elsewhere.
For more information about data residency regions, see [Organization settings](https://docs.beyondtrust.com/bt-docs/docs/organization-settings#how-regional-data-residency-works)​.
## PingOne
Log on to Pathfinder and PingOne. Work through the configuration with the applications open side-by-side.
1. Create a SAML application in PingOne.
1. Log in to your PingOne Admin Console as administrator.
2. Navigate to **Applications > Applications**, then click **+ Add Application** and select **SAML application**.
3. Select **Manually enter SAML configuration**.
4. For now, enter ACS URL as and Entity ID as (these are temporary; you’ll update these settings later).
5. Click **Save**, then toggle the application to enabled.
6. Download the metadata file. This file contains the temporary ACS URL and Entity ID values.
2. Create an IdP for PingOne in Pathfinder.
1. Sign into **login.beyondtrust.io**.
The **BeyondTrust Home** page displays.
2. At the top right of the page, click your site name to display a drop-down menu.
3. Select **Administration**.
The **BeyondTrust Pathfinder Administration** page opens and displays each available site as a tile.
4. From the ≡ menu, select **Identity & Authentication Providers**.
5. Click **Add Identity Provider**.
6. Add a name for the provider.
7. Click the box to upload the metadata file downloaded from PingOne. This imports the configuration needed to set up Ping as your IdP. By default, the import tool sets the ACS URL and Service Provider Entity ID to the same value when you import.
6. Click **Add Identity Provider**.
The SAML Configuration dialog box displays.
7. Click **Copy to Clipboard**.
3. Go back to PingOne.
1. Replace the placeholder values for ACS URL and Entity ID. Completing this step establishes the link between the Service Provider and the IdP for SAML.
2. Set attribute mapping:
1. **saml\_subject** maps to Username
2. **username** maps to Username
3. Save mappings and finish setup.
4. Test and finalize configuration.
1. In the Identity provider settings, leave the **Domain Name** box blank to test without email service domain binding.
2. Log on to Pathfinder via PingOne. Pathfinder detects a domainless IdP.
3. Select **PingOne** and click **Next**.
4. After successful login, go to the **Edit Identity Provider Settings** (step i. in this procedure) and update the domain to your actual email domain and click **Save Changes**.
5. Log on again after adding the domain name to ensure you can successfully log on to Pathfinder via PingOne.
After configuring your identity provider, you can edit it to select a PII region. The PII region allows you to select a region to store the personally identifiable information (PII) authentication data of users who are created by authenticating through this identity provider.
An identity provider region affects users only on first sign-in. If a user has already authenticated through the provider, and the provider's region is changed later, that user's PII authentication data is not automatically migrated.
If an identity provider's region is not set, those users are placed in the default US region, not in your organization region, even if your organization region is elsewhere.
For more information about data residency regions, see [Organization settings](https://docs.beyondtrust.com/bt-docs/docs/organization-settings#how-regional-data-residency-works)​.