anchor.diff:    }) {
       ssoProvider {
         state
  -      url
         ... on SSOProviderSAML {
           serviceProvider {
  -          issuer
  -          ssoURL
             metadata {
               url
             }
  +          ssoURL
  +          issuer
           }
         }
       }
  
positive.code:     ssoProvider {
        state
        url
      }
    }
  }
  ```
  
  If your SSO provider requests an ACS URL, you should provide the URL returned by the `url` property, for example `https://buildkite.com/sso/...`
  
  ### Step 4
  
  
negative.code:     id: "<provider id>",
      identityProvider: {
        metadata: {
          url: "https://myssoprovider.com/metadata/..."
        }
      }
    }) {
      ssoProvider {
        state
        url
        ... on SSOProviderSAML {
          serviceProvider {
            ssoURL
            issuer
          }
        }
      }
    }
  }
  ```
        
  If your SSO provider didn't provide a metadata URL, then copy SSO URL, Issuer (also known as Entity ID), and Certificate into the `ssoProviderUpdate` mutation:
        
  ```graphql
  mutation UpdateProviderMetaData {
  