> For the complete documentation index, see [llms.txt](https://knowledgebase.autorabit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.autorabit.com/product-guides/guard/getting-started-with-guard/single-sign-on-sso.md). # Single Sign-On (SSO) Single Sign-On (SSO) allows your organization to streamline and secure access to Guard by integrating with your corporate identity provider (IdP). Any SAML 2.0 IdP works, including Azure and Okta. ### Benefits of Using SSO * Enhanced Security: Centralized authentication through your IdP ensures strong password policies, MFA, and compliance with your security standards. * Simplified User Experience: Users log in once with their corporate account and gain access without needing separate Guard credentials. * Centralized User Management: Control user access through your IdP groups instead of managing accounts manually in Guard. * Improved Compliance & Auditing: Authentication and authorization are handled through a single, auditable system. ### How SSO Works with Guard Currently, Guard manages SSO through Keycloak. To set up SSO for your tenant: 1. Speak to us about getting support for enabling SSO. 2. Our team will help configure the integration with your IdP (e.g., Microsoft Entra ID). 3. Once configured, users assigned to the proper IdP groups will automatically be granted access to Guard (recommended default is Standard User privileges). Admins retain their permissions as defined in Guard. ### SSO-Only Authentication Guard supports a tenant setting called Only SSO Authentication. When this option is enabled: * Local tenant-manager users are automatically disabled. * The User Management section is hidden in the Guard app. * API-based user management is disabled. * Only SSO-authenticated users can log in. This mode ensures Guard access is exclusively controlled through your IdP, providing maximum security and centralized account lifecycle management. ### Best Practices * Coordinate with your IT/IdP administrators when enabling SSO. * Assign Guard access through IdP groups instead of creating users manually. * Enable SSO-only Authentication once you’re confident your IdP is fully managing user access. * Maintain at least two Admins in Guard during the transition to prevent lockouts. SSO in Guard provides a secure and scalable way to manage authentication, while shifting User Management to your organization’s IdP. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://knowledgebase.autorabit.com/product-guides/guard/getting-started-with-guard/single-sign-on-sso.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.