---
title: "Enable SAML Response Encryption"
slug: "enable-saml-response-encryption"
updated: 2026-08-06T11:17:38Z
published: 2026-08-06T11:17:38Z
canonical: "support.whatfix.com/enable-saml-response-encryption"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.whatfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable SAML Response Encryption

> [!WARNING]
> Note:
> 
> - Contact [support@whatfix.com](mailto:support@whatfix.com?subject=Enable%20SAML%20Response%20Encryption&body=Hi%20team%2C%0A%0AKindly%20enable%20SAML%20Response%20Encryption%20for%20my%20ENT.%0AENT%20ID%3A%0A%0AThanks%20and%20regards%2C) to enable SAML Response Encryption.
> - To enable SAML Response Encryption, Whatfix Single Sign On (SSO) must be enabled. Contact [support@whatfix.com](mailto:support@whatfix.com?subject=Enable%20Whatfix%20Single%20Sign%20On&body=Hi%20team%2C%0A%0AKindly%20enable%20Single%20Sign%20On%20for%20my%20account.%0AENT%20ID%3A%0A%0ARegards%20%26%20Thanks%2C%0A) to enable Whatfix SSO.

[Overview of SAML Response Encryption](/studio/docs/enable-saml-response-encryption#overview-of-saml-response-encryption)

[Provisions to enable SAML Response Encryption](/studio/docs/enable-saml-response-encryption#provisions-to-enable-saml-response-encryption)

## Overview of SAML Response Encryption

Consider that you want to log in to your Whatfix dashboard using [Whatfix Single Sign On (SSO)](/studio/docs/whatfix-single-sign-on). The login request goes from Whatfix to the Identity Provider (IdP) (IdP) to confirm your identity and facilitate login. Currently, the SSO response sent by the IdPs to Whatfix is sent as plain text. To improve the security of the information sent by the IdPs, Whatfix supports Security Assertion Markup Language (SAML) Response Encryption. With the SAML Response Encryption, Whatfix supports the provision for your IdPs to encrypt the SAML response provided by the IdPs.

> [!NOTE]
> Info:
> 
> The SAML response ensures that the request has come from Whatfix and enables you to log in to the Whatfix dashboard securely.

This response can then be decrypted by Whatfix using a private key. The SAML response encryption ensures that sensitive information in the response received from the IdP is protected during transmission.

## Provisions to enable SAML Response Encryption

The following are the provisions supported for SAML Response Encryption:

- Self Signed certificate
- Customer provided certificate

**Self Signed certificate**

In this scenario, the SAML Response Encryption is done by your IDP using a public certificate generated by Whatfix. Whatfix shares the public certificate with your IdP in advance for the IdP to encrypt the response. After which, decryption at Whatfix’s end is done using a private key, which is also generated by Whatfix.

**Customer provided certificate**

In this scenario, you need to generate the public certificate to do the SAML Response Encryption. After which, decryption at Whatfix’s end is done using a private key also provided by you. You need to share both the public certificate and private key with Whatfix.

An Identity Provider (IdP) is an authority system that holds and verifies user authentication information.

## Related

- [Enable SAML Request Signing for Single Sign On](/enable-saml-request-signing-for-single-sign-on.md)