Single sign-on and MFA

Every product supports single sign-on through OpenID Connect (OIDC) and SAML 2.0, so your team signs in with your existing identity provider.

Connect with OIDC

1. Open Admin → Settings → Single sign-on (the gear at the bottom of the icon rail) and choose OpenID Connect.
2. In your identity provider, create an application and set the redirect (callback) URL shown in the form.
3. Paste the issuer URL, client ID and client secret back into CloudVision360.
4. Test the connection with the Test sign-in button before you enforce it.

Connect with SAML

Create a SAML application in your IdP, upload or point to its metadata, and copy the service-provider metadata CloudVision360 gives you. Map the email and name assertions to the fields shown.

One sign-in for every product

With the CloudVision360 portal, people sign in once and open every product they use from My Apps; each product then signs them in with “Sign in with CloudVision360”. The All apps button at the bottom of each product’s icon rail switches between products.

Map groups to roles

Map identity-provider groups to platform roles so access is assigned automatically. Membership is re-evaluated at every sign-in, so removing someone from a group removes their access the next time they log in. (ITOps360 also re-applies group-to-role mapping at each sign-in for directory users.)

Multi-factor authentication

MFA is strongly recommended and required for sensitive products such as AgentVision360. When you use single sign-on, enforce MFA at your identity provider; the platform records the authentication method (MFA, SSO or password) with each session so high-risk actions can require a step-up.

Enforce

Once tested, set single sign-on to required so local passwords are no longer accepted, keeping a small number of break-glass administrator accounts as your provider recommends.