The image shows user authentication and integration for Oracle SaaS and PaaS services in an OCI Region, with integration to an external identity provider in a third-party cloud.

A region "Internet" contains an icon of people above the label "Users." Two arrows originate from "Users":

1. The arrow labeled "Oracle Fusion Apps URL IDP initiated SSO" leads to Oracle Fusion Cloud Applications under "SaaS Services" within a SaaS Tenancy labeled in the OCI Region.
2. The lower arrow is labeled "Oracle Visual Builder/Oracle Integration URL initiated SSO" and points to Oracle Integration under "PaaS Services" in the same tenancy.

Within the OCI Region:

• The diagram is divided into "SaaS Tenancy" containing two sections. The upper section is "SaaS Services", shows the Oracle Fusion Cloud Applications connected to Fusion Applications Identity Domain via a line labeled "IDP" and continuing right with a small label "SP" at the end of the line.
• The PaaS Services includes Oracle Integration, with a dashed arrow labeled "Provision" pointing up to Fusion Applications Identity Domain.

The OCI Region hosts a region labeled Third-Party Cloud which includes:

• An External Identity Provider with a left-pointing arrow labeled "IDP" that connects to Fusion Applications Identity Domain.
• An arrow labeled "Federation configured by customer" connects from Fusion Applications Identity Domain down to the Third-Party Cloud.