Single Sign-On (SSO)
Let your team sign in to ArmorIQ through your company's identity provider.
Single sign-on lets people on your company's email domain sign in to ArmorIQ through your identity provider (IdP) instead of a separate ArmorIQ password. You set it up yourself in Settings → Single sign-on.
Supported identity providers
| Provider | Protocol |
|---|---|
| Google Workspace | OpenID Connect (OIDC) |
| Okta, and any other provider that supports OIDC | OpenID Connect (OIDC) |
| Microsoft Entra ID (formerly Azure AD) | OpenID Connect (OIDC) |
ArmorIQ supports OIDC only. Okta, Microsoft Entra ID, Google Workspace and most other identity providers support it, so SAML is not needed.
Before you start
- You need the Org Admin or IAM Admin role in the organization.
- You need access to your company domain's DNS settings, to prove you own the domain.
- You need admin access to your identity provider, to create an app for ArmorIQ.
How setup works
The setup page walks you through four steps:
- Verify a domain: add a DNS TXT record that proves your company owns the domain.
- Connect provider: create an app in your identity provider and enter its details. See the guide for Google Workspace, Okta or Microsoft Entra ID.
- Test sign-in: sign in once through your identity provider to prove the connection works.
- Turn on: people on your verified domains can now sign in with SSO.
What changes for your team
- Signing in. On the sign-in page, people choose Continue with SSO and enter their work email. ArmorIQ sends them to your identity provider and back.
- SSO is optional. People can still sign in with email and password, Google or GitHub.
- Existing accounts are kept. Someone who already has an ArmorIQ account with the same email signs in to that account, with all their organizations.
- New people get their own workspace. Someone signing in for the first time gets a personal workspace. SSO does not add them to your organization; invite them to give them access.
Who can see and change SSO
| Role | Single sign-on page |
|---|---|
| Org Admin, IAM Admin | Full setup: domains, provider, test, turn on and off, remove |
| Developer, Viewer | Read-only: whether SSO is on, and for which domains |
| Analyst | No access |
Every change is recorded in the audit log with who made it.
Changing the provider settings turns SSO off until a new test sign-in passes. This keeps a mistyped value from locking your team out.