--- title: SSO and Authentication slug: sso-and-authentication description: Learn how to configure Single Sign-On (SSO) in Flare using SAML providers such as Microsoft Azure Active Directory, Okta, and Google. This document guides organization administrators in selecting the desired identity provider and choosing between "Enabled docTags: createdAt: 2023-10-02T17:34:04.624Z --- Flare supports SP-initiated Single Sign-On (SSO) through Google or a SAML provider, such as Microsoft Azure Active Directory or Okta. - **Google:** If your organization uses Google as its identity provider, no additional configuration is required. Selecting **Google** from the providers list is all you need to allow members to sign in with their Google accounts. Note that the Google account email must match the member's email address in Flare. - **SAML:** If your organization uses a SAML-supporting identity provider, such as Microsoft Azure AD, you will need to provide the following configuration values: - **Metadata URL:** Points to the metadata configuration of your SAML provider. - **Mapping Email:** Maps Flare's email attribute to the corresponding attribute in your SAML identity provider. For help obtaining these values from the Azure portal, refer to [SSO SAML Configuration](docId\:LbK46kdRtmQF-lE7yOarT). ## Configuration Modes SSO can be configured in two modes: - **Enabled:** SSO is available but not required. Members can still choose to sign in with their Flare password. - **Mandatory:** Members must sign in using SSO. Password authentication is disabled, and API access is limited to API keys only. Additionally, SSO can be configured at the organization level or at the individual tenant level, making it easy to manage multiple tenants with different identity providers. :::hint{type="info"} **Note:** - SSO can only be configured by administrators. - IdP-initiated SSO is currently not supported. ::: # Configuring SSO at the Organization Level Follow these steps to configure SSO at the organization level: 1. Navigate to the SSO configuration page. 2. Open the **Team **page. 3. Click **Edit **on the right panel. 4. Under **SSO Configuration**, select your desired identity provider. # Configuring SSO at the Tenant Level :::Iframe{iframeHeight="0" code="
"} ::: **** :::hint{type="info"} To configured SSO through SAML, see :InlineCtaButton[]{label="SSO SAML Configuration" docId="LbK46kdRtmQF-lE7yOarT" docAnchorId externalHref openInNewTab="true" noFollow="false"} ::: *** # Testing and Enabling SSO Follow these steps to test and enable SSO: ::::WorkflowBlock :::WorkflowBlockItem Browse to the Flare **Team** page and check the **Enable** option. Do not make it mandatory for now. ::: :::WorkflowBlockItem Log out from Flare. ::: :::WorkflowBlockItem Attempt to log back in by choosing **Log in with SSO**. You should get redirected to your identity provider for authentication. In the case where you are already connected, you should be instantly redirected to Flare's home page. If you were not connected, your identity provider will ask for your credentials ::Image[]{src="https://lh6.googleusercontent.com/5lLyMUqxmhwUIp6o-H-NiiAlfMmfKQUF3SWvOWrjrXyfiepvQvGDfM6GyElHQnpQTqI6YsPrzL7CgHcxtAUGZyP8Mpge94nNP1evSxfPZQyRhtkC3jCDJPRSKTnYsuHYPX9BplMmwgqOwZ4HUFU8HNQ" size="50" width="502" height="652" position="flex-start" darkWidth="502" darkHeight="652" showCaption="false"} ::: :::WorkflowBlockItem If successful, you can browse back to the **Team** page and set SSO as **Mandatory**. From this point on, users in your organization will only be able to log in with that method, and password authentication will be disabled. ::: :::: *** # Frequently Asked Questions :::ExpandableHeading **What identity providers does Flare support for SSO?** Flare supports two identity providers: - **SAML:** A widely compatible SSO method that works with most identity providers. - **Google** ::: :::ExpandableHeading **Does Flare support per-Tenant SSO?** Yes. Organization and tenant administrators can configure SSO for each tenant on the **Tenants** page. Organization administrators can assign users tenant SSO as their authentication method on the **Team** page. Alternatively, tenant administrators can invite new users, automatically assigning their authentication tenant. Users with tenant authentication can sign in using that tenant's SSO. If SSO is set to mandatory, they must use it. ::: :::ExpandableHeading **When logging in with tenant SSO, is my session scoped only to that Tenant?** No. Per-tenant SSO is a standard login option. Signing in with a tenant's SSO does not restrict access to other tenants you belong to. ::: :::ExpandableHeading **How does MFA work with SSO?** When signing in with SSO, Flare does not enforce MFA. It is the responsibility of your SSO provider to require MFA. ::: :::ExpandableHeading **Does Flare support IdP-initiated login flows?** Not yet. SSO users must initiate the login flow from the Flare app. This is known as SP-initiated SSO. ::: :::ExpandableHeading **What is the magic link login option?** Magic links let you sign in without a password by clicking a link sent to your account's email address. Magic links are not available for: - Users with MFA configured, as magic links are considered less secure than MFA. - Members of organizations where SSO is enforced, as those organizations require full control over authentication methods. ::: :::ExpandableHeading **Why is MFA or a magic link required to sign in to Flare?** Flare provides access to sensitive data, and this additional layer of security helps protect both your data and access to the platform. Password-only login is considered insecure, so users must configure MFA before signing in with a password. Alternatively, magic links can be used to sign in without a password. ::: :::ExpandableHeading **How long do Flare sessions last?** After signing in, your session remains active for up to one week. This duration cannot be configured. ::: :::ExpandableHeading **Does Flare support SSO bypass (break-the-glass)?** **Does Flare support SSO bypass (break-the-glass)?** No. When SSO is enforced in an organization, it applies to all users without exception. If you are locked out of SSO, please contact Flare Support. ::: *** # Related Articles :::CtaButton{label="SSO SAML Configuration" docId="LbK46kdRtmQF-lE7yOarT" openInNewTab="true"} ::: :::CtaButton{label="Profile" docId="MUFLZ4fa2xFLlfBc8TIYZ" openInNewTab="true"} ::: :::CtaButton{label="Policies" docId="bmzupnRd3txZNwn0VeUn2" openInNewTab="true"} ::: :::CtaButton{label="Identifiers" docId="DGkccVRbCbEYxLeaDWamU" openInNewTab="true"} :::