---
title: "Single Sign-On"
slug: "single-sign-on"
updated: 2025-06-10T14:09:27Z
published: 2025-06-10T14:09:27Z
canonical: "support.kandji.io/single-sign-on"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On

[Team Members](/v1/docs/team-member-role-permissions) have two options for logging into the Kandji Web App: **Standard Authentication** and **Single Sign-On (SSO)**. By default, Standard Authentication is activated for all tenants, offering login through Google, Microsoft, and email/password. Admins have the option to enable SSO using either native integrations or Custom SAML. Once an SSO setup is complete, Standard Authentication can be turned off, allowing SSO to be the only login method. SSO can also be used for Require Authentication in the Automated Device Enrollment Library Item. To learn more about requiring authentication during enrollment, see [this support article](/v1/docs/configuring-require-authentication-for-enrollment).

### SSO Connection Types

Kandji currently supports the following Single Sign-on connection types. Click on one of the following connection types to learn how it can be configured.

- [Single Sign-on with Microsoft Entra ID (Native)](/v1/docs/single-sign-on-with-microsoft-entra-id-native)
- [Single Sign-On with Microsoft Entra ID (SAML)](/v1/docs/single-sign-on-with-microsoft-entra-id-saml)
- [Single Sign-On with Google Workspace (Native)](/v1/docs/single-sign-on-with-google-workspace-native)
- [Single Sign-On with Google Workspace (SAML)](/v1/docs/single-sign-on-with-google-workspace-saml)
- [Single Sign-On with Okta (SAML)](/v1/docs/single-sign-on-with-okta-saml)
- [Single Sign-On with JumpCloud (SAML)](/v1/docs/single-sign-on-with-jumpcloud-saml)
- [Single Sign-On with OneLogin (SAML)](/v1/docs/single-sign-on-with-onelogin-saml)
- [Custom SAML-based Single Sign-On](/v1/docs/saml-based-single-sign-on)

### Enable and Manage a Connection

You can enable the connection once you have configured an SSO connection in both Kandji and your identity provider (IdP).

1. Click the **ellipsis** next to the connection name.
2. Click **Enable** from the menu. Connections can also be re-configured, deleted, and disabled from this menu.*![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0858AM@2x(1).png)*

#### Considerations

- An SSO connection does not need to be **Active** to be used for **Require Authentication** during Device Enrollment.
- A connection should only be **Active** in Settings if you want to authenticate Kandji administrators to the web app with that connection.
- Authentication to the Kandji Web App using SSO requires that the user has been invited as a Team Member.

### Enforcing Single Sign-On

Once you have configured at least one Single Sign-on connection, you can disable the Kandji Standard Authentication connection. Disabling Kandji Standard Authentication will disable the ability for Kandji administrators in your tenant to authenticate via Google or Microsoft social logins, and email/password.

> [!WARNING]
> Before disabling Kandji Standard Authentication, ensure your SSO connection is functioning correctly. We suggest verifying this by using a private browser window.

1. Navigate to the **Settings** page.
2. Click the **Access** tab and find the **Authentication** section.
3. Click the ellipsis next to **Standard Authentication.**
4. Click the **Disable** option.
5. A confirmation modal will open.
6. Click **Disable.**

If you lose access to your Kandji tenant via SSO and need to have Standard Authentication re-enabled, please [contact Kandji support](/v1/docs/access-to-kandji-support).

### Disabling or Deleting the Single Sign-On Connection

If you decide to stop using SSO, you can delete or disable a connection using the same ellipses used to enable it. When you delete or disable your last Single Sign-on connection, Kandji Standard Authentication will automatically be re-enabled to prevent tenant lockout.