docs: document multiple SAML domains (#12351)

docs/user-guide/tutorials/prowler-app-sso.mdx

@@ -5,6 +5,7 @@ sidebarTitle: 'SAML SSO'
 
 import { VersionBadge } from "/snippets/version-badge.mdx"
 import { AppliesTo } from "/snippets/applies-to.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
 
 <VersionBadge version="5.9.0" />
 
@@ -197,7 +198,7 @@ To complete the Prowler Cloud configuration:
 
 1.  Return to the Prowler SAML configuration page.
 
-2.  Enter the **email domain** for the organization (e.g., `mycompany.com`). Prowler Cloud uses this to identify users who should authenticate via SAML.
+2.  Enter the **primary email domain** for the organization (e.g., `mycompany.com`). Prowler Cloud uses this domain to generate the Assertion Consumer Service (ACS) URL. Every configured domain can identify users who authenticate through this SAML configuration.
 
 3.  Upload the **metadata XML file** downloaded from the IdP.
 
@@ -209,6 +210,33 @@ Click the "Save" button to complete the setup. The "SAML SSO Integration" card w
 
 ![Verify Integration Status](/images/prowler-app/saml/saml-sso-enabled.png)
 
+---
+
+### Add Multiple SAML Domains
+
+<VersionBadge version="5.38.0" />
+
+<SubscriptionBanner />
+
+Prowler Cloud supports one primary domain and up to 19 additional verified email domains in the same SAML configuration. Users from every configured domain authenticate through the same Identity Provider (IdP), so separate SAML applications are not required for each domain.
+
+<Note>
+A SAML configuration supports up to 20 email domains in total. One domain is required as the primary domain, leaving 19 slots for additional domains. Each subdomain counts as a separate additional domain. For example, `partners.example.com` counts separately from `example.com`.
+</Note>
+
+The ACS URL always uses the primary domain. Configure this single ACS URL in the IdP even when the SAML configuration includes additional domains.
+
+To add domains to a new or existing SAML configuration:
+
+1. Enter the domain in **Additional Email Domains**.
+2. Click **Add**. Each additional domain must be unique and must differ from the primary domain.
+3. Repeat these steps for every domain that must share the configuration.
+4. Click **Save** for a new configuration or **Update** for an existing configuration.
+
+![Prowler Cloud SAML configuration with multiple additional email domains](/images/prowler-app/saml/saml-multiple-domains.png)
+
+To remove an additional domain, click the remove button next to the domain, then click **Update**. Users from a removed domain can no longer start SAML authentication through this configuration.
+
 ### Remove SAML Configuration
 SAML SSO can be disabled by removing the existing configuration from the integration panel.
 ![Remove SAML configuration](/images/prowler-app/saml/saml-sso-remove.png)