• Login in to the CSO portal and navigate to Global / Tenant / Opco scope depending on Single Sign-on scope requirement. 
• Once the scope is selected, navigate to Settings -> Authentication page. For example in the below screenshot 'SSOTEST' tenant scope is selected and then Settings -> Authentication page is launched. 

• Now click on 'ADD SSO' or + sign in  Single Sign-On (SSO) Servers tab. 
• In the 'Add Single Sign-On' pop-up window, provide name and metadata file as shown in below screenshot.  

Note: In PRODUCTION environment IDP team provides the metadata.xml file which need to be uploaded in CSO. Once SSO server is created in CSO, click on the SSO -> View SAML Settings and download the MetaData and provide this MetaData file back to IDP team.

** Do not use downloaded MetaData file in CSO to create SSO server in CSO UI  **

Sample Metadata file CSO-SSO_METDAT1.xml

Note: If the metadata need to be reused to create SSO server in different tenant or opco then edit the "EntityDescriptor ID" and "entityID" by tweaking any character in the identifier. 
For example : 
Before editing : <EntityDescriptor ID="_2c10d245-e221-4bb5-ada8-473c7d80bde5" entityID="https://sts.windows.net/efa8df00-2eac-49a6-8d2c-1ea4fb57c647/"
After editing : <EntityDescriptor ID="_3c10d245-e221-4bb5-ada8-473c7d80bde5" entityID="https://sts.windows.net/dfa8df00-2eac-49a6-8d2c-1ea4fb57c647/"
 

• Once SSO server is created , authentication method for users can be updated as shown below.