> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Integration

> Configure Syteca to authenticate Management Tool users through your organization's Single Sign-On provider, including Azure, Okta, ForgeRock, and Keycloak.

Syteca can authenticate Management Tool users through your organization's SAML 2.0 Single Sign-On (SSO) provider instead of (or alongside) local and Active Directory accounts. Once configured, users log in through the **Log in with SSO** option on the Management Tool login page.

<Info>
  **Use this when:**

  * Your organization already centralizes application access through an identity provider and wants the Management Tool to follow the same login flow.
  * You need to enforce your organization's existing MFA and conditional access policies for Syteca administrators.
  * You want new Management Tool users provisioned automatically on first SSO login, instead of being created manually.

  Pair it with [LDAP targets](/docs/administration/integrations/ldap-targets) if you also want Active Directory group-based access alongside SSO.
</Info>

<Note>
  SSO authentication is not currently supported in [Multi-Tenant mode](/docs/administration/multi-tenant/overview).
</Note>

## Supported providers

Syteca integrates with any SAML 2.0 identity provider. These providers have dedicated setup guides:

<CardGroup cols={2}>
  <Card title="Azure SSO" icon="microsoft" href="/docs/administration/integrations/sso-azure">
    Configure through Azure Enterprise Applications.
  </Card>

  <Card title="Okta SSO" icon="shield" href="/docs/administration/integrations/sso-okta">
    Configure through an Okta SAML 2.0 app integration.
  </Card>

  <Card title="ForgeRock SSO" icon="lock" href="/docs/administration/integrations/sso-forgerock">
    Configure through ForgeRock AM entity providers.
  </Card>

  <Card title="Keycloak SSO" icon="key" href="/docs/administration/integrations/keycloak-sso">
    Configure through a Keycloak SAML client.
  </Card>
</CardGroup>

## What every integration configures in common

Regardless of provider, SSO setup always ends with the same Management Tool step: opening **Configuration → SSO Integration** and providing an **Issuer name** (your Management Tool URL) plus the identity provider's metadata or certificate. Each provider's page gives the exact fields and file formats it expects.

<Note>
  The **Auto-create a Management Tool account for a new user on the first SSO login** checkbox is selected by default. It automatically creates an internal or Active Directory user account the first time a user logs in through SSO, if that user doesn't already exist in the Management Tool. Deselect it to require users to be added manually before they can log in via SSO.

  Independently of this checkbox, Active Directory users who belong to an Active Directory group already added to the Management Tool can log in, even if they haven't been added individually.
</Note>

## Related

<CardGroup cols={2}>
  <Card title="LDAP targets" icon="folder-tree" href="/docs/administration/integrations/ldap-targets">
    Active Directory integration for user provisioning and login.
  </Card>

  <Card title="User management" icon="users" href="/docs/administration/users/users">
    Managing Management Tool user accounts and permissions.
  </Card>
</CardGroup>