Single Sign-On

Learn how to configure and manage Single Sign-On

Kandji Standard Authentication

Standard Authentication consists of the ability to sign in with Google Login, Azure AD (multi-tenant application), and Email/Password. All instances by default have Kandji Standard Authentication enabled. Kandji standard authentication can be disabled once an Enterprise SSO Connection has been created. 

Single Sign-On Feature Overview

Single Sign-On options are available to customers in 500+ device pricing plans. Customers below the 500 device tier can purchase SSO as an add-on for $150/month through their Customer Success Manager (billed annually). By default, all instances have Kandji Standard Authentication enabled. Below is an overview of what can be accomplished with different licensing types.

Adding a Single Sign-On Connection

Kandji currently supports the following Single Sign-On connection types. Click on one of the following connection types to learn how it can be configured. 

• Native Azure AD Application (Microsoft Identity Services APIv2) 
• Native Google Workspace Application 
• SAML based Single Sign-On (with support for SLO) 
  • Single Sign-On with OneLogin

Enable and manage a connection

Once you have configured an SSO connection in both Kandji and your identity provider (IDP), you can now enable the connection. This can be done using the following steps:

1. Click the ellipsis (three dots) next to the connection name.
2. Click Enable from the menu.
   
   Connections can additionally be re-configured, deleted, and disabled from this menu
   
   

Disabling or deleting the Single Sign-On connection

If you decide to no longer use Single Sign-On you can delete or disable a connection as shown above. When you delete or disable your last Single Sign-On connection, Kandji Standard Authentication will automatically be re-enabled to prevent account lockout. 

Enforcing Single Sign-On

Once you have configured at least one Single Sign-On connection, you can disable the Kandji Standard Authentication connection. Disabling Kandji standard authentication will disable the ability for Kandji administrators in your instance to authenticate via Email/Password, Google Sign in, or Office 365 Sign in. 

1. Navigate to the Settings page.
2. Click the Access tab.
3. Find the Authentication section. If that section does not currently exist, SSO is not enabled for your instance.
4. Click the ellipsis next to Standard Authentication.
5. Click the Disable option.
   
   
6. A confirmation modal will open. Click Disable.