--- title: "Single Sign-On with Okta (SAML)" slug: "single-sign-on-with-okta-saml" updated: 2025-06-10T14:08:06Z published: 2025-06-10T14:08:06Z canonical: "support.kandji.io/single-sign-on-with-okta-saml" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-On with Okta (SAML) ### Create a SAML Connection 1. In Kandji, navigate to the **Settings** page 2. Click the **Access** tab 3. Find the **Authentication** section and click the **Add** button on the bottom left of the authentication section (If that section does not appear, SSO is not enabled for your tenant) ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0804AM@2x(1).png) 4. In the Add SSO Connection pane, select the **Custom SAML** option 5. Click **Next** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0806AM@2x.png) 6. Select **Show Advanced Details** 7. Copy the **Assertion Consumer Service URL** and save it in a text document for later use 8. Copy the **Entity ID** and save it too **![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/9bzr8jou8tzogj25e0n_4mskk44tntqokq.png)** 9. Leave this browser tab open as you proceed with the instructions below ### Configure the Kandji App in Okta 1. In a new browser tab, log in to your Okta tenant 2. On the left-hand side, click the reveal triangle next to **Applications** 3. Click **Applications![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/saju0kk2shfvrryetxc-lrjdodkev9b-1g.png)** 4. Click **Create App Integration![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/mrdg_oada03a500v1vah5hab2iq6-ku8nw.png)** 5. Select **SAML 2.0** as the app integration type and click **Next** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/xbza07kzkjsoqjpllkuruiulckes0jhxpw.png) 6. Enter an **App name** 7. Upload an optional **App logo** 8. Click **Next** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/zylu7xmatoclbdhd8k0bsfjvj0dxz_en5w.png) 9. In the **Single sign-on URL** field, paste the Kandji Assertion Consumer Service URL that was copied earlier 10. In the **Audience URI (SP Entity ID)** field, paste the Kandji Entity ID that was copied earlier 11. Ensure that the **Name ID format** is set to **Unspecified** 12. Ensure that the **Application username** is set to **Okta username** 13. Ensure that the **Update application username on** is set to **Create and update** 14. Select **Next** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/mykyvsasbwfg-bkw2oim6ceipucbpwrqfg.png) ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/tmxvsajub86up3aodwufbco3h6qrksljqq.png) 15. Select **I'm an Okta customer adding an internal app** 16. Select **This is an internal app that we have created** 17. Click **Finish. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/czrijcyzxtyjqqdxj0khid7qugr06apobw.png)** 18. Back at the **Sign On** tab, find the link to **View SAML setup instructions** and open it in a new browser tab ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6dnqr7cqlnjv1x9x3swohzjnpyc4-ovomg.png) 19. Copy the **Single Sign-On URL** and save it in a text document for later use in Kandji 20. Download the certificate file and save it for use in Kandji ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/v0v5ek818w9lxdc5rnwne6azduwux3yyig.png) ### Add a test user to the Okta app 1. Go back to the Okta app and click the **Assignments** tab 2. Click the **Assign** dropdown menu and click **Assign to People** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/z2xi-q44lfamiezln1oc82iy5prsen3fxw.png) 3. Search for a test user to Assign 4. Once the user is assigned, click **Done![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/axguvv04hzia8lhr-reskdcaihizenqx-q.png)** 5. You should see the user that you have selected in the list**![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/o8fdi1nfjilt7h24n4fuyj0vwy5zb-ywcq.png)** ### Configure the SAML connection in Kandji 1. Go back to the Custom SAML integration in Kandji 2. Give the connection a **Name** 3. Paste the Single Sign-On URL you copied from Okta into the **Sign In URL** text field ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/5ycmnwc_7be3zbdr_ck3t8ljpgnighgcsw.png) 4. Upload the Okta certificate you downloaded earlier 5. Ensure that the **User ID Attribute** is set to the default value of ```bash http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier ``` ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/eavj7mn4bj58m9ygobvjott1b7ezmhjmlq.png) 6. Ensure **Sign Request** is set to **Yes** 7. Ensure **Request Algorithm** is set to **RSA-SHA256** 8. Ensure **Sign Request Algorithm Digest** is set to **SHA 256** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/cchs48qm6kx810hy1avn31a0ikknjf9qpa.png) 9. Set the **Protocol Binding** to **HTTP-Redirect** 10. **Save** the connection and click **Cancel** to close the configuration pane![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/rekpht7x24lf3beswqaetn8-re5vu2_vug.png) ### Enable the SAML Connection Once you have configured the SAML connection in both Kandji and your identity provider, you can now enable the connection. Please refer to the **Enable and Manage a Connection** section in our [Single Sign-on support article](/v1/docs/single-sign-on) for step-by-step instructions. ### Enforcing Single Sign-on Once you have configured at least one Single Sign-on connection, you can disable the standard authentication connection. Disabling Kandji standard authentication will disable the ability for Kandji administrators in your tenant to authenticate via email/password, Google Sign in, or Office 365 Sign in. Please refer to our [Single Sign-on support article](/v1/docs/single-sign-on) for step-by-step instructions. ### **Add a Test User to Kandji** 1. Add a test user to the **Admin Team** in Kandji by clicking **New User**. 2. Fill in all of the corresponding user information. This user must exist in Okta and must be assigned to the Okta SSO app in your Okta tenant. 3. Click **Submit**. 4. Once the invite is submitted, close the Invite User window. 5. Refresh the Access page in Kandji. You should see the user who was just added. 6. Go to the user’s email to accept the invite and log in with the new SAML SSO connection.