---
id: "474ec022-9bb8-4312-a6d4-32fc72e67368"
name: "SFSU SAML Entry"
micro_summary: "SFSU Gateway uses Microsoft tenant d8fbe335; SAML request query values are ephemeral and account-choice, password, MFA, or consent screens are human stops."
status: "resolved"
see_also: [{"target": "4bc33a5d-cfd8-44c6-a3fa-78d4fb88fbc6", "reason": "Gateway is the safe origin for generating a fresh SFSU SAML request."}]
scope: "Verified Microsoft Entra SAML entry point for SFSU Gateway and the safe stopping boundary during account selection or authentication."
warnings: "Never hardcode or reuse SAMLRequest or RelayState. Stop at account choice, password, MFA, or consent."
---
## Verified route

`https://gateway.sfsu.edu/` redirects to the tenant path `https://login.microsoftonline.com/d8fbe335-822c-41a9-8774-7f16709aac9f/saml2` with page title `Sign in to your account`.

The `SAMLRequest`, `RelayState`, and related query values are generated per launch; never persist or replay them. Start from Gateway instead. An account chooser is an ambiguity boundary even when one remembered account is shown: stop rather than selecting or choosing `Use another account`. Password, MFA, and consent screens are also human stops.