anchor.diff:      id: "<provider id>",
       identityProvider: {
         metadata: {
  -        url: "<meta-data URL>"
  -      }
  +        url: "https://myssoprovider.com/meta-data/..."
  +      }
  +    }
  +  }) {
  +    ssoProvider {
  +      state
  +      url
  +    }
  +  }
  +}
  +```
  +      
  +If your SSO provider doesn't provide a metadata URL, you can specify the the SSO URL, Issuer (also known as Entity ID), and Certificate to the `ssoProviderUpdate` mutation:
  +      
  +```graphql
  +mutation UpdateProviderMetaData {
  +  ssoProviderUpdate(input: {
  +    id: "<provider id>",
  +    identityProvider: {
  +      ssoURL: "https://myssoprovider.com/...",
  +      issuer: "https://myssoprovider.com/...",
  +      certificate: "---BEGIN CERT---..."
       }
     }) {
       ssoProvider {
  
positive.code:           url
            ... on SSOProviderSAML {
              identityProvider {
                issuer
                certificate
                ssoURL
                metadata {
                  xml
                  url
  
negative.code:   <p>See the <code>SSOProviderUpdatePayload</code> documentation for other properties that can be configured on your SSO provider, such as <code>sessionDurationInHours</code> and <code>note</code>.</p>
  </section>
  
  ## Setting up SAML (Google Cloud Identity, Okta, OneLogin, ADFS and others)
  
  ### Step 1
  
  