You want users to sign in to ChromeOS devices via SAML Single Sign-On and be able to access websites and cloud services that rely on the same identity provider without having to re-enter credentials. How should you configure SAML?

The goal is to enable SAML for both device login and subsequent in-session web access. This requires two key configurations. First, SAML-based Single Sign-On must be enabled for ChromeOS devices in the Google Admin console. Second, to allow seamless access to other SAML-enabled web services, the "Single Sign-On cookie behavior" policy must be set to transfer the IdP's SSO cookie into the user's browser session after they log in to the device. This prevents users from having to re-authenticate.

A. IdP-initiated login is a specific SAML flow but doesn't configure the ChromeOS device login or the necessary cookie transfer.
C. This configures SSO for specific web apps but does not enable SAML for the primary ChromeOS device sign-in.
D. Chrome App Builder is a deprecated tool and is not the correct method for configuring fundamental SAML SSO for devices.

1. Google. (n.d.). Configure SAML single sign-on for ChromeOS devices. Google Chrome Enterprise Help. Retrieved from https://support.google.com/chrome/a/answer/10483112. (This guide explicitly details the steps, including enabling the "Single sign-on" setting and configuring the "Single Sign-On cookie behavior" for in-session authentication, see Step 2 and Step 3).

2. Google. (n.d.). Security settings. Google Chrome Enterprise Help. Retrieved from https://support.google.com/chrome/a/answer/1375678#security. (This policy list details the "Single Sign-On cookie behavior" setting, explaining its function to transfer cookies into the user session).