diff --git a/tidb-cloud/tidb-cloud-org-sso-authentication.md b/tidb-cloud/tidb-cloud-org-sso-authentication.md
index c1d9a4ec05c6d..0b73a19c122a6 100644
--- a/tidb-cloud/tidb-cloud-org-sso-authentication.md
+++ b/tidb-cloud/tidb-cloud-org-sso-authentication.md
@@ -186,13 +186,20 @@ If you have an identity provider that uses the SAML identity protocol, you can e
 
 In TiDB Cloud, the SAML authentication method is disabled by default. After enabling Cloud Organization SSO, you can enable and configure the SAML authentication method as follows:
 
-1. Get the following information from your identity provider for TiDB Cloud Organization SSO:
+1. On the **Authentication** page of your TiDB Cloud console, locate the row of SAML in the **Authentication Methods** area, and then click <svg width="16" height="16" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M12 20H21M3.00003 20H4.67457C5.16376 20 5.40835 20 5.63852 19.9447C5.84259 19.8957 6.03768 19.8149 6.21663 19.7053C6.41846 19.5816 6.59141 19.4086 6.93732 19.0627L19.5001 6.49998C20.3285 5.67156 20.3285 4.32841 19.5001 3.49998C18.6716 2.67156 17.3285 2.67156 16.5001 3.49998L3.93729 16.0627C3.59139 16.4086 3.41843 16.5816 3.29475 16.7834C3.18509 16.9624 3.10428 17.1574 3.05529 17.3615C3.00003 17.5917 3.00003 17.8363 3.00003 18.3255V20Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path></svg> to show the SAML method details.
+2. From the **Authentication Method Details** pane, copy the following values provided by TiDB Cloud:
+
+    - **Entity ID**: it is the service provider (SP) entity ID for TiDB Cloud.
+    - **Postback URL**: it is the SAML endpoint (also known as the Assertion Consumer Service (ACS) URL or Reply URL) to which your identity provider sends SAML responses.
+
+3. In your identity provider, use the **Entity ID** and **Postback URL** from the previous step to create or configure a SAML application for TiDB Cloud. If an SSO team manages your identity provider, provide these values to that team.
+
+    Then, get the following information from your identity provider:
 
     - Sign on URL
     - Signing Certificate
 
-2. On the **Authentication** page of your TiDB Cloud console, locate the row of SAML in the **Authentication Methods** area, and then click <svg width="16" height="16" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M12 20H21M3.00003 20H4.67457C5.16376 20 5.40835 20 5.63852 19.9447C5.84259 19.8957 6.03768 19.8149 6.21663 19.7053C6.41846 19.5816 6.59141 19.4086 6.93732 19.0627L19.5001 6.49998C20.3285 5.67156 20.3285 4.32841 19.5001 3.49998C18.6716 2.67156 17.3285 2.67156 16.5001 3.49998L3.93729 16.0627C3.59139 16.4086 3.41843 16.5816 3.29475 16.7834C3.18509 16.9624 3.10428 17.1574 3.05529 17.3615C3.00003 17.5917 3.00003 17.8363 3.00003 18.3255V20Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path></svg> to show the SAML method details.
-3. In the method details, you can configure the following:
+4. Return to the **Authentication Method Details** pane in the TiDB Cloud console, and then configure the following:
 
     - **Name**
 
@@ -226,7 +233,7 @@ In TiDB Cloud, the SAML authentication method is disabled by default. After enab
 
         Before enabling **SCIM Provisioning Accounts**, add and verify the email domains for users to be provisioned, and configure them in the **Allowed Email Domains** field.
 
-4. Click **Save**.
+5. Click **Activate**.
 
 #### Configure SCIM provisioning