Single Sign-On

By Bre'Anna Scott

Learn how to configure and manage Single Sign-on

Note: Microsoft Entra ID is the new name for Azure AD (Azure Active Directory)

Kandji Standard Authentication

Standard Authentication consists of the ability to sign in with Google Login, Microsoft Entra ID (multi-tenant application), and Email/Password. All instances have Kandji Standard Authentication enabled by default. Kandji Standard Authentication can be disabled once an Enterprise SSO Connection has been created, and an admin user is logged into the Kandji Web App with an SSO account. 

Adding a Single Sign-On Connection

Kandji currently supports the following Single Sign-on connection types. Click on one of the following connection types to learn how it can be configured. 

Enable and Manage a Connection

Once you have configured an SSO connection in both Kandji and your identity provider (IdP), you can now enable the connection. 

  1. Click the ellipsis (three dots) next to the connection name.
  2. Click Enable from the menu. Connections can additionally be re-configured, deleted, and disabled from this menu


An SSO connection does not need to be Active in Settings > Access in order to be used for Require Authentication within Automated Device Enrollment. A connection should only be Active in Settings if you want to authenticate Kandji administrators to the web app with that connection. Authentication to the WebApp using SSO requires that you also have a Team Member Account.

Disabling or Deleting the Single Sign-On Connection

If you decide to no longer use Single Sign-on, you can delete or disable a connection as shown above. When you delete or disable your last Single Sign-on connection, Kandji Standard Authentication will automatically be re-enabled to prevent account lockout. 

Enforcing Single Sign-On

Once you have configured at least one Single Sign-on connection, you can disable the Kandji Standard Authentication connection. Disabling Kandji Standard Authentication will disable the ability for Kandji administrators in your instance to authenticate via Email/Password, Google Sign in, or Office 365 Sign in. 

Do not disable Kandji Standard Authentication until you have confirmed your SSO connection works. We recommend verification via a private browser window.
  1. Navigate to the Settings page.
  2. Click the Access tab and find the Authentication section. If that section does not currently exist, SSO is not enabled for your instance.
  3. Click the ellipsis next to Standard Authentication.
  4. Click the Disable option.
  5. A confirmation modal will open. Click Disable.