SSO & passkeys
Control how people in Example Logistics Co. (demo) sign in and how long they stay signed in.
SAML / OIDC setup
SAML 2.0 · OpenID Connect
ACS URL (read-only, copy) · Entity ID (read-only, copy) · IdP metadata URL or Upload metadata XML
Issuer URL · Client ID · Client secret
Connection works. Signed in as member@example.com. · Your IdP returned an error: AADSTS50105. Check the ACS URL and certificate.
SCIM
The token is shown once. Store it in your identity provider straight away.
Passkeys
Allow passkeys
Users can sign in with Face ID, Touch ID, Windows Hello or a security key. Works alongside SSO.
Domain verification
Add this TXT record to your DNS, then select Verify: rp-verify=…
Session policy
MFA enforcement
Require MFA for everyone
Break-glass access
2 named emergency accounts that bypass SSO if your identity provider is down. Each needs a hardware security key.