Single sign-on
Set up SAML 2.0 sign-in for the AgentKeeper dashboard with Okta, Microsoft Entra ID, Google Workspace, or any SAML IdP.
SSO controls who can sign in to the AgentKeeper dashboard. It is separate from directory sync, which controls who appears in policy audiences. Most organizations set up both.
| Where | Settings → Access → SSO |
| Plan | Enterprise |
| Role | Owner or Admin |
| Protocol | SAML 2.0 |
Supported providers
| Provider | What you create |
|---|---|
| Okta | A SAML 2.0 application |
| Microsoft Entra ID | An Enterprise Application with SAML single sign-on |
| Google Workspace | A custom SAML app in Google Admin |
| Any other IdP | A generic SAML 2.0 application |
Set it up
Create the app in your IdP
Okta and Entra: create the SAML app and assign the users or groups who should reach AgentKeeper.
Google Workspace: create a custom SAML app and upload the AgentKeeper metadata shown in Settings → Access → SSO.
Paste the IdP metadata
In Settings → Access → SSO, add a connection and paste either the IdP metadata URL or the metadata XML.
Claim your domains
Add the email domains this connection covers. A domain can belong to only one SSO connection.
Test with a second browser
Sign in from a private window with an account assigned to the IdP app. Keep your current admin session open so you are not locked out if the mapping is wrong.
Verify
The user lands in the dashboard with the role their org_members row grants.
SSO authenticates people; it does not assign roles. Set roles in
Members and roles.
Removing a connection
Deleting an SSO connection releases its domains and drops the provider. Users in those domains fall back to password sign-in. Confirm at least one owner has a working password before you delete.