Single Sign-On and SCIM

​

SSO

New in 3.3 Admins now set up single sign-on themselves at Settings → User Management → SSO. There’s no need to contact ThreatAware. The page walks you through four steps: choose a provider, choose a setup mode, connect, and choose how users are provisioned.

​

Set up SSO

​

Automatic setup (Azure AD)

1. Choose the Provisioning type and Default user role first (see Provisioning). Authorising grants the permissions that provisioning type needs.
2. Click Authorise and sign in to Microsoft as a Global Administrator.
3. Review and accept the permissions. You’re returned to a ThreatAware page that says whether it worked. SSO is live as soon as it does; there’s no separate step to switch it on.

If it didn’t work, or you need to grant new permissions later, click Authorise again. Re-authorising reuses the existing enterprise application in Entra, so your user and group assignments stay as they are. Once it’s connected, current ThreatAware users who also exist in your Azure AD tenant can sign in through SSO. To make SSO the only way in, turn on Enforce SSO.

​

Manual setup (SAML)

1. In your identity provider, create a SAML application for ThreatAware.
2. Copy the SAML identifier from the SSO page into your application as its identifier (Entity ID).
3. Copy the Reply URL from the SSO page into your application as its reply or callback URL (ACS URL).
4. Copy your application’s SAML Metadata URL and paste it into the SSO page.

The metadata URL must be a full URL with a host name, such as https://host.example.com/metadata.

​

Provisioning

Provisioning type decides how users get into ThreatAware. Which types you can pick depends on your provider and setup mode (see the table under SSO): Default user role is given to every user your identity provider provisions. If you don’t choose one, users get Limited Viewer, which is read-only. That’s why the JIT option in the app says it “Creates a read-only account”. You can change individual users’ roles later. Start with Limited Viewer or a tight custom role. Each provisioning type changes what admins can do on the Users page. For example, with SCIM you can’t add users by hand. See Users provisioned by SSO.

​

Enforce SSO

Turn on Enforce SSO to require every user to sign in through your identity provider. The switch stays locked, with the tooltip “SSO can be enforced once all your users are provisioned”, until SSO is connected and every user is provisioned. With JIT and Enforce SSO both on, admins can’t add users at Settings → Users. People get an account by signing in through your identity provider. While SSO isn’t enforced, users can still sign in with an email and password, so keep at least one such account as a break-glass account in case your identity provider has an outage.

​

Disconnecting SSO

Click Disconnect in the Choose a provider step. Users fall back to email-and-password sign-in, and the SSO connection settings are cleared. With Azure AD automatic setup, Disconnect also deletes the enterprise application ThreatAware created in Entra. To switch provider, change the setup mode or change the metadata URL, you have to disconnect first.

​

SCIM provisioning

New in 3.3 With SCIM, you manage ThreatAware users entirely from your identity provider, such as Entra ID. When someone joins, moves role or leaves, ThreatAware follows automatically, with nobody updating accounts by hand. That closes off stale accounts, which helps when you’re evidencing joiner, mover and leaver controls for ISO 27001 or Cyber Essentials. What SCIM does:

• Joiners: users assigned to the ThreatAware app are created in ThreatAware.
• Changes: name and attribute updates flow through automatically.
• Leavers: users removed or disabled in your identity provider are disabled in ThreatAware, not deleted, so their audit history stays intact.
• Roles and teams: map identity provider groups to ThreatAware roles and teams.

​

Set up SCIM

​

Rotate the SCIM token

With manual setup, click Rotate token to issue a new token. The current token is revoked straight away, so provisioning stops until you paste the new token into your identity provider. You can rotate the token once SSO is enabled.

​

Still on ThreatAware 3.2?

SSO on ThreatAware 3.2

On ThreatAware 3.2, only Microsoft Entra ID is self-service. Okta and other SAML 2.0 / OIDC providers are set up by ThreatAware: contact your account team with your tenant details. SCIM isn’t available.Entra ID setup (3.2)A Global Admin must authorise the setup application.

1. Go to Settings → Single Sign-On and click Enable Single Sign-On.
2. Click Authorize, sign in to Microsoft as a Global Admin and consent.
3. Wait 30 seconds for the setup application to propagate.
4. Click Enable in stage 2. ThreatAware creates the SSO Enterprise Application in your tenant.
5. Existing ThreatAware users whose mail attribute matches a user in Entra ID get SSO automatically.

Managing users (3.2)

• Add users at Settings → Users and tick Enable SSO. Removing a user, or turning SSO off for them, removes them from the Entra ID application.
• Break-glass accounts without SSO are supported.
• Auto-provisioning (group-based access from Entra ID) is turned on by ThreatAware support. Assigned users are created with the Limited Viewer role, and an admin upgrades them afterwards.

​

Next steps