title: Azure AD - Where to add the public key certificate from the Service Provider to encrypt the SAML assertion
body: <p>I have been given a Public Key Certificate by the Service Provider (ArcGIS Online) which I want to use to encrypt the assertion sent from Azure AD (IdP).</p>
  <p>Do I import the certificate (with KeyDescriptor=&quot;encryption&quot;) under Single Sign On &gt; SAML Signing Certificate</p>
  <p><a href="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/certificate-signing-options" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/certificate-signing-options</a></p>
  <p>Or under Token Encryption</p>
  <p><a href="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption</a></p>
  <p>The SAML Signing Certificate page has the option to &quot;Encrypt assertion&quot;, but the help page for Token Encryption suggests that this is the place to import a certificate to encrypt an assertion. Please explain the difference between the two locations where certificates can be imported.</p>