---
title: Implement SSO and SLO
description: Implement SAML 2.0 single sign-on and single logout in PingAM using integrated or standalone mode
component: pingam
version: 8
page_id: pingam:am-saml2:saml2-sso-slo
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-saml2/saml2-sso-slo.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-06-01T14:34:20Z
keywords: ["SAML 2.0", "Single Sign-on (SSO)", "Federation"]
page_aliases: ["saml2-guide:saml2-sso-slo.adoc"]
superseded_by: https://docs.pingidentity.com/pingam/8.1/am-saml2/saml2-sso-slo.html
---

# Implement SSO and SLO

AM provides two options for implementing SSO and SLO with SAML 2.0:

* Integrated mode

  Integrated mode single sign-on and single logout uses a SAML2 authentication node on a service provider (SP), thereby integrating SAML 2.0 authentication into the AM authentication process. The authentication node handles the SAML 2.0 protocol details for you.

  |   |                                                                                                                                                                                                                                                                              |
  | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | Integrated mode supports **SP-initiated single sign-on only** because the authentication service that includes the SAML 2.0 node resides on the SP. You can't trigger IdP-initiated single sign-on in an integrated mode implementation.Integrated mode doesn't support SLO. |

* Standalone mode

  Standalone mode requires that you invoke JSPs pages to initiate single sign-on and SLO.

|   |                                                                                                                                                                                      |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|   | You can also configure web and Java agents to work alongside AM when performing SSO and SLO. Find out more in [Web or Java agents SSO and SLO](using-saml2-with-policy-agents.html). |

The following table provides information to help you decide whether to implement integrated mode or standalone mode for your AM SAML 2.0 deployment:

**Integrated or standalone mode?**

| Deployment task or requirement                                                            | Implementation mode                                |
| ----------------------------------------------------------------------------------------- | -------------------------------------------------- |
| You want to deploy only SAML 2.0 SSO using the easiest technique.                         | Use [integrated mode](saml2-integrated-mode.html). |
| You want to deploy both SAML 2.0 SSO and SLO.                                             | Use [standalone mode](saml2-standalone-mode.html). |
| You want to trigger SAML 2.0 IdP-initiated SSO.                                           | Use [standalone mode](saml2-standalone-mode.html). |
| You want to use the SAML 2.0 Enhanced Client or Proxy (ECP) single sign-on profile.       | Use [standalone mode](saml2-standalone-mode.html). |
| Your IdP and SP instances are using the same domain name; for example, `mydomain.net`.(1) | Use [standalone mode](saml2-standalone-mode.html). |

(1) Due to the way integrated mode tracks authentication status by using a cookie, it can't be used when both the IdP and SP share a domain name.