diff --git a/app/forms/firewall-rules-common.tsx b/app/forms/firewall-rules-common.tsx
index b0935c893..da348ee21 100644
--- a/app/forms/firewall-rules-common.tsx
+++ b/app/forms/firewall-rules-common.tsx
@@ -36,8 +36,10 @@ import { useVpcSelector } from '~/hooks/use-params'
 import { Badge } from '~/ui/lib/Badge'
 import { toComboboxItems, type ComboboxItem } from '~/ui/lib/Combobox'
 import { FormDivider } from '~/ui/lib/Divider'
+import { FieldLabel } from '~/ui/lib/FieldLabel'
 import { Message } from '~/ui/lib/Message'
 import * as MiniTable from '~/ui/lib/MiniTable'
+import { SideModal } from '~/ui/lib/SideModal'
 import { TextInputHint } from '~/ui/lib/TextInput'
 import { KEYS } from '~/ui/util/keys'
 import { ALL_ISH } from '~/util/consts'
@@ -415,46 +417,50 @@ export const CommonFields = ({ control, nameTaken, error }: CommonFieldsProps) =
 
       {/* Really this should be its own <form>, but you can't have a form inside a form,
           so we just stick the submit handler in a button onClick */}
-      <div className="flex flex-col gap-3">
-        <h3 className="mb-4 text-sans-2xl">Targets</h3>
-        <Message
-          variant="info"
-          content={
-            <>
+      <SideModal.Heading>Targets</SideModal.Heading>
+
+      <Message
+        variant="info"
+        content={
+          <>
+            <p>
               Targets determine the instances to which this rule applies. You can target
-              instances directly by name, or specify a VPC, VPC subnet, IP, or IP subnet,
-              which will apply the rule to traffic going to all matching instances. Targets
-              are additive: the rule applies to instances matching{' '}
+              instances directly or specify a VPC, VPC subnet, IP, or IP subnet, which will
+              apply the rule to traffic going to all matching instances.
+            </p>
+            <p className="mt-2">
+              Targets are additive: the rule applies to instances matching{' '}
               <span className="underline">any</span> target.
-            </>
-          }
-        />
-        <DynamicTypeAndValueFields
-          sectionType="target"
-          control={targetForm.control}
-          valueType={targetType}
-          items={toComboboxItems(targetItems[targetType])}
-          // HACK: reset the whole subform, keeping type (because we just set
-          // it). most importantly, this resets isSubmitted so the form can go
-          // back to validating on submit instead of change
-          onTypeChange={() =>
-            targetForm.reset({ type: targetForm.getValues('type'), value: '' })
-          }
-          onInputChange={(value) => targetForm.setValue('value', value)}
-          onSubmitTextField={submitTarget}
-        />
-        <MiniTable.ClearAndAddButtons
-          addButtonCopy="Add target"
-          disableClear={!targetValue}
-          onClear={() => targetForm.reset()}
-          onSubmit={submitTarget}
-        />
-      </div>
+            </p>
+          </>
+        }
+      />
+
+      <DynamicTypeAndValueFields
+        sectionType="target"
+        control={targetForm.control}
+        valueType={targetType}
+        items={toComboboxItems(targetItems[targetType])}
+        // HACK: reset the whole subform, keeping type (because we just set
+        // it). most importantly, this resets isSubmitted so the form can go
+        // back to validating on submit instead of change
+        onTypeChange={() =>
+          targetForm.reset({ type: targetForm.getValues('type'), value: '' })
+        }
+        onInputChange={(value) => targetForm.setValue('value', value)}
+        onSubmitTextField={submitTarget}
+      />
+      <MiniTable.ClearAndAddButtons
+        addButtonCopy="Add target"
+        disableClear={!targetValue}
+        onClear={() => targetForm.reset()}
+        onSubmit={submitTarget}
+      />
       {!!targets.value.length && <TypeAndValueTable sectionType="target" items={targets} />}
 
       <FormDivider />
 
-      <h3 className="mb-4 text-sans-2xl">Filters</h3>
+      <SideModal.Heading>Filters</SideModal.Heading>
       <Message
         variant="info"
         content={
@@ -468,12 +474,12 @@ export const CommonFields = ({ control, nameTaken, error }: CommonFieldsProps) =
       />
 
       <div className="flex flex-col gap-3">
-        {/* We have to blow this up instead of using TextField to get better 
+        {/* We have to blow this up instead of using TextField to get better
             text styling on the label */}
         <div className="mt-2">
-          <label id="portRange-label" htmlFor="portRange" className="text-sans-lg">
+          <FieldLabel id="portRange-label" htmlFor="portRange">
             Port filters
-          </label>
+          </FieldLabel>
           <TextInputHint id="portRange-help-text" className="mb-2">
             A single destination port (1234) or a range (1234&ndash;2345)
           </TextInputHint>
@@ -523,45 +529,47 @@ export const CommonFields = ({ control, nameTaken, error }: CommonFieldsProps) =
       )}
 
       <fieldset className="space-y-0.5">
-        <legend className="mb-2 mt-4 text-sans-lg">Protocol filters</legend>
+        {/* todo: abstract this label and checkbox pattern */}
+        <FieldLabel id="portRange-label" htmlFor="portRange" className="mb-2">
+          Protocol filters
+        </FieldLabel>
         <ProtocolField control={control} protocol="TCP" />
         <ProtocolField control={control} protocol="UDP" />
         <ProtocolField control={control} protocol="ICMP" />
       </fieldset>
 
-      <div className="flex flex-col gap-3">
-        <h3 className="mt-4 text-sans-lg">Host filters</h3>
-        <Message
-          variant="info"
-          content={
-            <>
-              Host filters match the &ldquo;other end&rdquo; of traffic from the
-              target&rsquo;s perspective: for an inbound rule, they match the source of
-              traffic. For an outbound rule, they match the destination.
-            </>
-          }
-        />
-        <DynamicTypeAndValueFields
-          sectionType="host"
-          control={hostForm.control}
-          valueType={hostType}
-          items={toComboboxItems(hostFilterItems[hostType])}
-          // HACK: reset the whole subform, keeping type (because we just set
-          // it). most importantly, this resets isSubmitted so the form can go
-          // back to validating on submit instead of change
-          onTypeChange={() =>
-            hostForm.reset({ type: hostForm.getValues('type'), value: '' })
-          }
-          onInputChange={(value) => hostForm.setValue('value', value)}
-          onSubmitTextField={submitHost}
-        />
-        <MiniTable.ClearAndAddButtons
-          addButtonCopy="Add host filter"
-          disableClear={!hostValue}
-          onClear={() => hostForm.reset()}
-          onSubmit={submitHost}
-        />
-      </div>
+      <FormDivider />
+
+      <SideModal.Heading>Host filters</SideModal.Heading>
+
+      <Message
+        variant="info"
+        content={
+          <>
+            Host filters match the &ldquo;other end&rdquo; of traffic from the
+            target&rsquo;s perspective: for an inbound rule, they match the source of
+            traffic. For an outbound rule, they match the destination.
+          </>
+        }
+      />
+      <DynamicTypeAndValueFields
+        sectionType="host"
+        control={hostForm.control}
+        valueType={hostType}
+        items={toComboboxItems(hostFilterItems[hostType])}
+        // HACK: reset the whole subform, keeping type (because we just set
+        // it). most importantly, this resets isSubmitted so the form can go
+        // back to validating on submit instead of change
+        onTypeChange={() => hostForm.reset({ type: hostForm.getValues('type'), value: '' })}
+        onInputChange={(value) => hostForm.setValue('value', value)}
+        onSubmitTextField={submitHost}
+      />
+      <MiniTable.ClearAndAddButtons
+        addButtonCopy="Add host filter"
+        disableClear={!hostValue}
+        onClear={() => hostForm.reset()}
+        onSubmit={submitHost}
+      />
       {!!hosts.value.length && <TypeAndValueTable sectionType="host" items={hosts} />}
 
       {error && (
diff --git a/app/forms/idp/create.tsx b/app/forms/idp/create.tsx
index 42004e88e..1d97d53ca 100644
--- a/app/forms/idp/create.tsx
+++ b/app/forms/idp/create.tsx
@@ -18,6 +18,8 @@ import { SideModalForm } from '~/components/form/SideModalForm'
 import { HL } from '~/components/HL'
 import { useSiloSelector } from '~/hooks/use-params'
 import { addToast } from '~/stores/toast'
+import { FormDivider } from '~/ui/lib/Divider'
+import { SideModal } from '~/ui/lib/SideModal'
 import { readBlobAsBase64 } from '~/util/file'
 import { pb } from '~/util/path-builder'
 
@@ -109,21 +111,15 @@ export function CreateIdpSideModalForm() {
       <NameField name="name" control={form.control} />
       <DescriptionField name="description" control={form.control} required />
       <TextField
-        name="acsUrl"
-        label="ACS URL"
-        description="Service provider endpoint for the IdP to send the SAML response"
-        required
-        control={form.control}
-      />
-      {/* TODO: help text */}
-      <TextField name="idpEntityId" label="Entity ID" required control={form.control} />
-      <TextField
-        name="sloUrl"
-        label="Single Logout (SLO) URL"
-        description="Service provider endpoint for log out requests"
+        name="technicalContactEmail"
+        label="Technical contact email"
         required
         control={form.control}
       />
+
+      <FormDivider />
+
+      <SideModal.Heading>Service provider</SideModal.Heading>
       {/* TODO: help text */}
       <TextField
         name="spClientId"
@@ -132,22 +128,23 @@ export function CreateIdpSideModalForm() {
         control={form.control}
       />
       <TextField
-        name="groupAttributeName"
-        label="Group attribute name"
-        description="Name of the SAML attribute in the IdP response listing the user’s groups"
+        name="acsUrl"
+        label="ACS URL"
+        description="Service provider endpoint for the IdP to send the SAML response"
+        required
         control={form.control}
       />
-      {/* TODO: Email field, probably */}
       <TextField
-        name="technicalContactEmail"
-        label="Technical contact email"
+        name="sloUrl"
+        label="Single Logout (SLO) URL"
+        description="Service provider endpoint for log out requests"
         required
         control={form.control}
       />
-      <MetadataSourceField control={form.control} />
+
       {/* We don't bother validating that you have both of these or neither even
-              though the API requires that because we are going to change the API to
-              always require both, at which point these become simple `required` fields */}
+          though the API requires that because we are going to change the API to
+          always require both, at which point these become simple `required` fields */}
       <FileField
         id="public-cert-file-input"
         name="signingKeypair.publicCert"
@@ -162,6 +159,19 @@ export function CreateIdpSideModalForm() {
         label="Private key"
         control={form.control}
       />
+
+      <FormDivider />
+
+      <SideModal.Heading>Identity Provider</SideModal.Heading>
+      {/* TODO: help text */}
+      <TextField name="idpEntityId" label="Entity ID" required control={form.control} />
+      <TextField
+        name="groupAttributeName"
+        label="Group attribute name"
+        description="Name of the SAML attribute in the IdP response listing the user’s groups"
+        control={form.control}
+      />
+      <MetadataSourceField control={form.control} />
     </SideModalForm>
   )
 }
diff --git a/app/forms/idp/edit.tsx b/app/forms/idp/edit.tsx
index b51d1d904..966aace09 100644
--- a/app/forms/idp/edit.tsx
+++ b/app/forms/idp/edit.tsx
@@ -17,8 +17,9 @@ import { TextField } from '~/components/form/fields/TextField'
 import { SideModalForm } from '~/components/form/SideModalForm'
 import { getIdpSelector, useIdpSelector } from '~/hooks/use-params'
 import { DateTime } from '~/ui/lib/DateTime'
+import { FormDivider } from '~/ui/lib/Divider'
 import { PropertiesTable } from '~/ui/lib/PropertiesTable'
-import { ResourceLabel } from '~/ui/lib/SideModal'
+import { ResourceLabel, SideModal } from '~/ui/lib/SideModal'
 import { Truncate } from '~/ui/lib/Truncate'
 import { pb } from '~/util/path-builder'
 
@@ -73,17 +74,28 @@ export function EditIdpSideModalForm() {
       <NameField name="name" control={form.control} disabled />
       <DescriptionField name="description" control={form.control} required disabled />
       <TextField
-        name="acsUrl"
-        label="ACS URL"
-        description="Service provider endpoint for the IdP to send the SAML response"
+        name="technicalContactEmail"
+        label="Technical contact email"
         required
         control={form.control}
         disabled
       />
+
+      <FormDivider />
+
+      <SideModal.Heading>Service provider</SideModal.Heading>
       {/* TODO: help text */}
       <TextField
-        name="idpEntityId"
-        label="Entity ID"
+        name="spClientId"
+        label="Service provider client ID"
+        required
+        control={form.control}
+        disabled
+      />
+      <TextField
+        name="acsUrl"
+        label="ACS URL"
+        description="Service provider endpoint for the IdP to send the SAML response"
         required
         control={form.control}
         disabled
@@ -96,10 +108,14 @@ export function EditIdpSideModalForm() {
         control={form.control}
         disabled
       />
+
+      <FormDivider />
+
+      <SideModal.Heading>Identity Provider</SideModal.Heading>
       {/* TODO: help text */}
       <TextField
-        name="spClientId"
-        label="Service provider client ID"
+        name="idpEntityId"
+        label="Entity ID"
         required
         control={form.control}
         disabled
@@ -112,14 +128,6 @@ export function EditIdpSideModalForm() {
         control={form.control}
         disabled
       />
-      {/* TODO: Email field, probably */}
-      <TextField
-        name="technicalContactEmail"
-        label="Technical contact email"
-        required
-        control={form.control}
-        disabled
-      />
     </SideModalForm>
   )
 }
diff --git a/app/pages/system/silos/SiloPage.tsx b/app/pages/system/silos/SiloPage.tsx
index db8bf4c64..65a634a7d 100644
--- a/app/pages/system/silos/SiloPage.tsx
+++ b/app/pages/system/silos/SiloPage.tsx
@@ -62,7 +62,12 @@ export function SiloPage() {
           heading="silos"
           icon={<Cloud16Icon />}
           summary="Silos provide strict tenancy separation between groups of users. Each silo has its own resource limits and access policies as well as its own subdomain for the web console and API."
-          links={[docLinks.systemSilo, docLinks.systemIpPools, docLinks.access]}
+          links={[
+            docLinks.systemSilo,
+            docLinks.identityProviders,
+            docLinks.systemIpPools,
+            docLinks.access,
+          ]}
         />
       </PageHeader>
 
diff --git a/app/ui/lib/SideModal.tsx b/app/ui/lib/SideModal.tsx
index 63b1d8926..62d478c5e 100644
--- a/app/ui/lib/SideModal.tsx
+++ b/app/ui/lib/SideModal.tsx
@@ -170,6 +170,8 @@ function SideModalBody({ children }: { children?: ReactNode }) {
 
 SideModal.Body = SideModalBody
 
+SideModal.Heading = classed.div`text-sans-semi-xl`
+
 SideModal.Section = classed.div`p-8 space-y-6 border-secondary`
 
 SideModal.Footer = ({ children, error }: { children: ReactNode; error?: boolean }) => (
diff --git a/app/util/links.ts b/app/util/links.ts
index 48c88d5ee..ef5a5aec4 100644
--- a/app/util/links.ts
+++ b/app/util/links.ts
@@ -19,6 +19,8 @@ export const links = {
   imagesDocs: 'https://docs.oxide.computer/guides/creating-and-sharing-images',
   preparingImagesDocs:
     'https://docs.oxide.computer/guides/creating-and-sharing-images#_preparing_images_for_import',
+  identityProvidersDocs:
+    'https://docs.oxide.computer/guides/system/completing-rack-config#_configure_silo_identity_provider',
   instanceActionsDocs: 'https://docs.oxide.computer/guides/managing-instances',
   // TODO: link to section
   instanceBootDiskDocs: 'https://docs.oxide.computer/guides/deploying-workloads',
@@ -72,6 +74,10 @@ export const docLinks = {
     href: links.keyConceptsIamPolicyDocs,
     linkText: 'Key Concepts',
   },
+  identityProviders: {
+    href: links.identityProvidersDocs,
+    linkText: 'Identity Providers',
+  },
   images: {
     href: links.imagesDocs,
     linkText: 'Images',