[fahreddinozcan]

Adds a cloud Entra ID SSO guide so customers stop reading the Azure APIM gateway guide as the SSO setup.

• New page enterprise-managed-auth/entra-sso: SAML URL exchange, Entra app setup, test link, existing-account pitfall
• Auth sidebar: "Microsoft Entra ID" now holds "SSO" and "Azure APIM gateway"; APIM page URL is unchanged
• APIM page: note at top says it is optional and not needed for SSO
• Security page: adds the cloud SSO link and marks the APIM link as optional

Linear: CTX7-3720

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
context7-admin-mcp	Ignored		Nov 10, 2026 10:14am UTC

[linear-code]

CTX7-3720

[context7]

Docs7 for context7.com

Result	Status	Action
Deployment	✅ Ready	Open preview
Content review	✅ Passed. No problems found.	—

Commit e9b665e · Updated 2026-11-10 10:15 UTC · View build details

[ramazanoacar]

Thanks Fahreddin, this will save a lot of confusion. Putting the "you don't need APIM for SSO" note at the top of both pages is exactly what was missing, and the "Existing accounts" section covers the issue that usually catches teams after rollout. Approving 👍

Small notes (non-blocking)

• Two pages now have nearly the same title: the on-prem /enterprise/security/entra-sso is "Microsoft Entra ID (SSO)", and this one is "Microsoft Entra ID SSO". In search results and on the security page they look the same. Adding "for Context7 Cloud" (or "Cloud") to this title would tell them apart.
• On the security page, the list starts with "For step-by-step configuration on self-hosted deployments, see:", but the new link (and the APIM one) are for Cloud. Splitting it into "Context7 Cloud" and "On-Premise" lists would fix that.
• "From the Microsoft My Apps portal" is IdP-initiated sign-in, which has to be allowed on the SSO connection. If it's on by default for every connection we create, all good; if not, it may be worth saying we turn it on, or dropping that line.