docs: limit SSO OpenID Connect to Microsoft Entra ID (#26517)

## Summary

The setup page said Docker supports any OIDC-compatible identity
provider. SSO supports any SAML 2.0 identity provider, and OpenID
Connect only with Microsoft Entra ID. The FAQ field list, certificate
markers, and UPN expansion now match the setup procedure. OAuth 2.0 is
not a separate SSO connection type.

@netlify /security/authentication/single-sign-on/connect/

Preview:

-
https://deploy-preview-26517--docsdocker.netlify.app/security/authentication/single-sign-on/connect/
-
https://deploy-preview-26517--docsdocker.netlify.app/security/authentication/single-sign-on/
- https://deploy-preview-26517--docsdocker.netlify.app/faqs/security/

Generated by Grok

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

content/manuals/faqs/security.md

@@ -1,6 +1,6 @@
 ---
 description: Frequently asked questions about Docker single sign-on, identity providers, user management, SSO enforcement, and domain verification
-keywords: Docker, Docker Hub, SSO FAQs, single sign-on, identity providers, IdP, SAML, Entra ID, user management, SCIM, JIT, administration, security, SSO enforcement, SSO domains, domain verification, DNS, TXT records
+keywords: Docker, Docker Hub, SSO FAQs, single sign-on, identity providers, IdP, SAML, OIDC, Entra ID, user management, SCIM, JIT, administration, security, SSO enforcement, SSO domains, domain verification, DNS, TXT records
 title: Security FAQs
 linkTitle: Security
 weight: 20
@@ -58,7 +58,13 @@ Yes, Docker supports your IdP's session timeout using a custom `dockerSessionMin
 
 ### Can I use multiple identity providers with Docker SSO?
 
-Yes, Docker supports multiple IdP configurations. A domain can be associated with multiple IdPs. Docker supports Entra ID (formerly Azure AD) and identity providers that support SAML 2.0.
+Yes. Docker supports multiple IdP configurations, and a domain can be associated with multiple IdPs.
+
+### Which identity providers does Docker SSO support?
+
+Docker supports any SAML 2.0 identity provider, and Microsoft Entra ID (formerly Azure AD) for OpenID Connect (OIDC). In Docker Home, choose the **SAML 2.0** or **Azure AD (OIDC)** connection type. OAuth 2.0 is not a separate SSO connection type.
+
+SCIM provisions users and is separate from sign-in. See [Provision users](/manuals/security/provisioning/_index.md).
 
 ### Can I change my identity provider after configuring SSO?
 
@@ -66,10 +72,16 @@ Yes. Delete your existing IdP configuration in your Docker SSO connection, then
 
 ### What information do I need from my identity provider to configure SSO?
 
-To turn on SSO in Docker, you need the following from your IdP:
+Paste these values from your IdP into Docker:
 
-- SAML: Entity ID, ACS URL, Single Logout URL, and the public X.509 certificate
-- Entra ID (formerly Azure AD): Client ID, Client Secret, AD Domain
+- SAML 2.0, including Microsoft Entra ID SAML: the SAML sign-in URL and the
+  public X.509 certificate. Entra ID calls the sign-in URL **Login URL**.
+- Microsoft Entra ID for OpenID Connect (OIDC): **Client ID**, **Client
+  Secret**, and **Azure AD Domain**.
+
+Copy the SAML **Entity ID** and **ACS URL**, or the OIDC **Redirect URI**, from
+Docker and paste them into your IdP. See
+[Set up single sign-on](/manuals/security/authentication/single-sign-on/connect.md).
 
 ### What happens if my existing certificate expires?
 

content/manuals/security/authentication/single-sign-on/_index.md

@@ -7,8 +7,8 @@ description: >-
   enforcement.
 keywords: single sign-on, SSO, sign-in, admin, Docker Hub, Docker Home,
   security, identity provider, IdP, SSO configuration, SSO setup, Docker
-  Business, AI Governance, SAML, domain verification, enforce SSO, JIT
-  provisioning, personal access token
+  Business, AI Governance, SAML, OIDC, Microsoft Entra ID, domain verification,
+  enforce SSO, JIT provisioning, personal access token
 aliases:
   - /single-sign-on/
   - /admin/company/settings/sso/
@@ -21,9 +21,11 @@ weight: 10
 {{< summary-bar feature_name="SSO" >}}
 
 Single sign-on (SSO) lets users access Docker by authenticating through your
-identity provider (IdP). You can configure SSO for an entire company,
-including all associated organizations, or for a single organization. SSO
-requires a Docker Business subscription or an
+identity provider (IdP). Docker supports any SAML 2.0 identity provider, and
+Microsoft Entra ID (formerly Azure AD) for OpenID Connect (OIDC). You can
+configure SSO for an entire company, including all associated organizations,
+or for a single organization. SSO requires a Docker Business subscription or
+an
 [AI Governance](/manuals/accounts/organization/manage/manage-licenses.md)
 license.
 

content/manuals/security/authentication/single-sign-on/connect.md

@@ -23,9 +23,11 @@ aliases:
 {{< summary-bar feature_name="SSO" >}}
 
 To set up a single sign-on (SSO), you need to establish a connection between
-Docker and your identity provider (IdP). While this guide uses Okta and
-Microsoft Entra ID as a working example, the general process remains the same
-for other IdPs.
+Docker and your identity provider (IdP). Docker supports any SAML 2.0 identity
+provider, and Microsoft Entra ID (formerly Azure AD) for OpenID Connect (OIDC).
+This guide uses Okta for SAML 2.0 and Microsoft Entra ID for SAML 2.0 and OIDC.
+For another SAML 2.0 provider, follow the SAML steps with that provider's
+values.
 
 If you're unfamiliar with the SSO process, first review
 [SSO overview](/manuals/security/authentication/single-sign-on/_index.md) to
@@ -33,12 +35,11 @@ learn about how SSO works.
 
 ## Prerequisites
 
-Docker supports any SAML 2.0 or OIDC-compatible identity provider. Before you
-begin, make sure the following conditions are met:
+Before you begin, make sure the following conditions are met:
 
 - Notify your company about the upcoming SSO sign-in process.
 - Confirm that each Docker user has a valid IdP account using the same email
-  address as their Unique Primary Identifier (UPN).
+  address as their User Principal Name (UPN).
 - Ensure CI/CD pipelines use PATs or OATs instead of passwords.
 
 ## Set up an SSO connection
@@ -249,7 +250,8 @@ Complete the integration by pasting your IdP values into Docker.
 > [!IMPORTANT]
 >
 > When prompted to copy a certificate, copy the entire certificate starting with
-> `----BEGIN CERTIFICATE----` and including the `----END CERTIFICATE----` lines.
+> `-----BEGIN CERTIFICATE-----` and including the
+> `-----END CERTIFICATE-----` lines.
 
 {{< tabs >}}
 {{< tab name="Okta SAML" >}}