# With external SSO (Google/Microsoft/Custom)

In this scenario, Defguard is only the VPN system and enrollment is used just to obtain credentials to configure the [Defguard Desktop Client](https://docs.defguard.net/1.4/using-defguard-for-end-users/desktop-client).

Please go to the enrollment URL, like: <https://enrollment.company.com> and choose Enrollment:

<figure><img src="https://content.gitbook.com/content/qA26Hk2bOkuJXJg4scJ4/blobs/1KaIvyRBmXIb585PKguX/Screenshot%202024-11-15%20at%2018.48.20.png" alt="" width="563"><figcaption></figcaption></figure>

Then all you have to do is click on your SSO login - the button name depends on the SSO you have configured:

<figure><img src="https://content.gitbook.com/content/qA26Hk2bOkuJXJg4scJ4/blobs/i6NLVQjYfHvAkTMyWuHj/Screenshot%202024-11-15%20at%2018.49.54.png" alt=""><figcaption></figcaption></figure>

Now log in with your SSO and after successful login process, you will receive information how to configure your desktop client:

<figure><img src="https://content.gitbook.com/content/qA26Hk2bOkuJXJg4scJ4/blobs/ACfzHBYT9a1BCKWYSXjt/Screenshot%202024-11-15%20at%2018.52.56.png" alt=""><figcaption></figcaption></figure>

Download the [Defguard desktop client](https://defguard.net/download/), and [enter *Instance URL* and *token* shown on this screen - more details here](https://docs.defguard.net/1.4/using-defguard-for-end-users/enrollment/broken-reference).