docs: expand OAuth SCM setup with Auth Profile step-by-step guide

aigw/product/mcp-gateway/authentication/cas.mdx

@@ -60,26 +60,57 @@ See [CIE Directory Sync](/aigw/product/enterprise-offering/org-management/direct
 
 ## Setup
 
-CAS authentication is automatically enabled. No additional configuration is required on the MCP Gateway side — the gateway routes authentication through CAS.
+CAS authentication is automatically enabled on the MCP Gateway — no gateway-side configuration is needed. The admin configures identity and access in **SCM** and **CIE** before users can connect.
 
-### What the Admin Needs to Configure
+<Steps>
+
+<Step title="Connect a directory in CIE">
+
+Open the **CIE Console** and add your identity provider (Entra ID, Okta, or on-prem Active Directory) as a connected directory. This is the source of truth for users and groups.
+
+See [Palo Alto CIE documentation](https://docs.paloaltonetworks.com/identity/cloud-identity-engine/authenticate-users-with-the-cloud-identity-engine) for provider-specific setup instructions.
+
+</Step>
+
+<Step title="Configure Directory Sync in SCM">
 
-| Step | Where | What |
-|------|-------|------|
-| 1. Connect a directory | CIE Console | Add your identity provider (Entra ID, Okta, AD) to CIE |
-| 2. Configure Directory Sync | AI Gateway → Admin Settings | Select the connected directory and user identity attribute |
-| 3. Select Auth Profile | AI Gateway → Admin Settings | Choose the CAS authentication profile for MCP auth |
-| 4. Map groups to workspaces | AI Gateway → Admin Settings | Map CIE groups to AI Gateway workspaces |
+Navigate to **AI Security** → **AI Gateway** → **Admin Settings** → **Authentication** → **Directory Sync**.
+
+1. Select the **Connected Directory** you added in the previous step.
+2. Choose the **User Identity Attribute** — either **UPN (User Principal Name)** or **Mail (Primary Email)**.
+3. Click **Save**.
+
+<Note>
+The User Identity Attribute must match the email attribute your identity provider returns during CAS authentication. If there is a mismatch, authenticated users cannot be resolved.
+</Note>
+
+See [CIE Directory Sync](/aigw/product/enterprise-offering/org-management/directory-sync/cie-directory-sync) for a full walkthrough.
+
+</Step>
+
+<Step title="Select an Auth Profile">
+
+On the same Directory Sync page, open the **Auth Profile** dropdown and select the authentication profile that should handle MCP login flows.
+
+![Directory Sync configuration — Auth Profile dropdown showing available authentication profiles](/images/cas-auth-profile.png)
+
+Auth Profiles are synced from [Authentication Profiles](https://docs.paloaltonetworks.com/identity/cloud-identity-engine/authenticate-users-with-the-cloud-identity-engine) configured in CIE. The selected profile determines which identity provider users see on the CAS login page.
 
 <Warning>
-**Don't skip the Auth Profile step.** Selecting an Authentication Profile (Step 3) is required for the CAS login flow to work. Without it, users will not be redirected to the CAS login page and authentication will fail silently. This is the most commonly missed configuration step.
+**Do not skip this step.** Without an Auth Profile selected, users will not be redirected to the CAS login page and authentication will fail silently. This is the most commonly missed configuration step.
 </Warning>
 
-<Note>
-**Email claim is required.** CAS identifies users by their email address. The identity provider must include the user's email in the authentication claims. If the email claim is missing, the user cannot be resolved and authentication will fail.
+</Step>
 
-Ensure that the **User Identity Attribute** selected in CIE Directory Sync (UPN or Mail) matches the email attribute returned by your identity provider during CAS authentication.
-</Note>
+<Step title="Map groups to workspaces">
+
+In the **Group Mappings** section, map CIE directory groups to AI Gateway workspaces. Each mapping is a 1:1 link — all members of a mapped group are automatically provisioned into the corresponding workspace.
+
+Users must belong to at least one mapped workspace to access MCP servers provisioned in that workspace.
+
+</Step>
+
+</Steps>
 
 ---