> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On and SCIM

> Set up single sign-on with Microsoft Entra ID (Azure AD), Okta or CyberArk, and provision users automatically with just-in-time or SCIM

## SSO

Available on

New in 3.3 Admins now set up single sign-on themselves at **Settings → User Management → SSO**. There's no need to contact ThreatAware. The page walks you through four steps: choose a provider, choose a setup mode, connect, and choose how users are provisioned.

| Provider | Setup modes | Provisioning types |
| - | - | - |
| **Azure AD (Microsoft Entra ID)** | Automatic or Manual | Automatic: None, JIT or SCIM. Manual: JIT or SCIM. |
| **Okta** | Manual | JIT or SCIM |
| **CyberArk** | Manual | JIT. SCIM isn't supported yet: contact support to enable it. |

> [!NOTE]
>
> **SSO matches users on the `mail` attribute, not the User Principal Name (UPN).** Make sure `mail` is populated for your users in your identity provider before you turn SSO on, or sign-ins fail with "user not found".

### Set up SSO

**1. Choose a provider**

Go to **Settings → User Management → SSO** and choose **AzureAD**, **Okta** or **CyberArk**. You need the **SSO Setup** permission (the app sometimes calls it SSO Configuration), which only Super Admin has by default (see [Role permissions](https://docs.threataware.com/reference/role-permissions.md)).

**2. Choose a setup mode**

* **Automatic** (Azure AD only): connect through OAuth in one click, with no SAML configuration.
* **Manual** (all providers): configure the SAML connection yourself, for full control.

**3. Connect**

Follow the steps for your setup mode below. **View setup guide** on the page shows them too. When it works, the page shows **SSO enabled**.

**4. Choose how users are provisioned**

Pick a **Provisioning type** and a **Default user role**, and decide whether to enforce SSO. See [Provisioning](#provisioning).

**5. Save**

Click **Save** in the bar at the bottom of the page.

#### Automatic setup (Azure AD)

> [!WARNING]
>
> **Global Administrator required.** Global Administrator is the minimum Entra role that can approve the permissions. ThreatAware then creates an enterprise application in your Azure AD tenant for you.

1. Choose the **Provisioning type** and **Default user role** first (see [Provisioning](#provisioning)). Authorising grants the permissions that provisioning type needs.
2. Click **Authorise** and sign in to Microsoft as a Global Administrator.
3. Review and accept the permissions. You're returned to a ThreatAware page that says whether it worked. SSO is live as soon as it does; there's no separate step to switch it on.

If it didn't work, or you need to grant new permissions later, click **Authorise** again. Re-authorising reuses the existing enterprise application in Entra, so your user and group assignments stay as they are.

Once it's connected, current ThreatAware users who also exist in your Azure AD tenant can sign in through SSO. To make SSO the only way in, turn on [Enforce SSO](#enforce-sso).

#### Manual setup (SAML)

1. In your identity provider, create a SAML application for ThreatAware.
2. Copy the **SAML identifier** from the SSO page into your application as its identifier (Entity ID).
3. Copy the **Reply URL** from the SSO page into your application as its reply or callback URL (ACS URL).
4. Copy your application's SAML **Metadata URL** and paste it into the SSO page.

The metadata URL must be a full URL with a host name, such as `https://host.example.com/metadata`.

### Provisioning

**Provisioning type** decides how users get into ThreatAware. Which types you can pick depends on your provider and setup mode (see the table under [SSO](#sso)):

| Type | What happens |
| - | - |
| **None** (Azure AD automatic setup only) | Accounts stay manual: an admin adds each user at [Settings → Users](https://docs.threataware.com/settings/users.md). SSO only signs users in. |
| **JIT** (just-in-time) | An account is created the first time someone signs in through SSO, with the **Default user role**. Their name and email are refreshed each time they sign in. ThreatAware never deletes the account. |
| **SCIM** | Your identity provider creates, updates and disables users in ThreatAware. See [SCIM provisioning](#scim-provisioning). |

**Default user role** is given to every user your identity provider provisions. If you don't choose one, users get **Limited Viewer**, which is read-only. That's why the JIT option in the app says it "Creates a read-only account". You can change individual users' roles later. Start with **Limited Viewer** or a tight custom role.

Each provisioning type changes what admins can do on the Users page. For example, with SCIM you can't add users by hand. See [Users provisioned by SSO](https://docs.threataware.com/settings/users.md#users-provisioned-by-sso).

### Enforce SSO

Turn on **Enforce SSO** to require every user to sign in through your identity provider. The switch stays locked, with the tooltip "SSO can be enforced once all your users are provisioned", until SSO is connected and every user is provisioned.

With JIT and Enforce SSO both on, admins can't add users at Settings → Users. People get an account by signing in through your identity provider.

While SSO isn't enforced, users can still sign in with an email and password, so keep at least one such account as a break-glass account in case your identity provider has an outage.

> [!WARNING]
>
> Once **Enforce SSO** is on, nobody can sign in with a password. If your identity provider is unavailable, everyone is blocked from ThreatAware until it's back, or until you contact [ThreatAware support](mailto:support@threataware.com).

### Disconnecting SSO

Click **Disconnect** in the **Choose a provider** step. Users fall back to email-and-password sign-in, and the SSO connection settings are cleared. With Azure AD automatic setup, Disconnect also deletes the enterprise application ThreatAware created in Entra. To switch provider, change the setup mode or change the metadata URL, you have to disconnect first.

## SCIM provisioning

Available on

New in 3.3 With SCIM, you manage ThreatAware users entirely from your identity provider, such as Entra ID. When someone joins, moves role or leaves, ThreatAware follows automatically, with nobody updating accounts by hand. That closes off stale accounts, which helps when you're evidencing joiner, mover and leaver controls for ISO 27001 or Cyber Essentials.

What SCIM does:

* **Joiners:** users assigned to the ThreatAware app are created in ThreatAware.
* **Changes:** name and attribute updates flow through automatically.
* **Leavers:** users removed or disabled in your identity provider are disabled in ThreatAware, not deleted, so their audit history stays intact.
* **Roles and teams:** map identity provider groups to ThreatAware roles and teams.

### Set up SCIM

**1. Choose SCIM**

Set up [SSO](#set-up-sso) first, then choose **SCIM** under **Provisioning type**.

With Azure AD automatic setup, SCIM needs extra permissions. If your connection wasn't granted them, the page asks you to **Re-authorise AzureAD**. Approve ThreatAware again in Microsoft before you save.

**2. Copy the SCIM URL and token**

With manual setup, ThreatAware shows a **SCIM URL** (the SCIM connector base URL) and a **Token**. The token is shown in full only once, so copy both straight into your identity provider. The SCIM token is separate from your [API keys](https://docs.threataware.com/settings/api-access.md).

With Azure AD automatic setup there's nothing to copy: ThreatAware sets up provisioning in Entra itself, creating the application and assigning its certificate. Skip the next step.

**3. Configure your identity provider**

With manual setup, follow the steps for your provider below.

**4. Map groups to roles and teams**

Once your identity provider has pushed its groups to ThreatAware, map them under **Group to role mapping** and **Group to team mapping**. Each group can map to only one role.

**Microsoft Entra ID**

1. In the Microsoft Entra admin center, open **Enterprise applications** and select your ThreatAware application.
2. Go to **Provisioning** and set **Provisioning Mode** to **Automatic**.
3. Paste the SCIM URL into **Tenant URL**, and the token into **Secret Token**.
4. Click **Test Connection**, then **Save**.
5. Under **Users and groups**, assign your users, then start provisioning.

**Okta**

1. In Okta, open your ThreatAware SSO application and select the **Provisioning** tab.
2. Under **Settings**, choose **Integration** and click **Edit**.
3. Paste the SCIM URL into **SCIM connector base URL**.
4. Set **Unique identifier field for users** to `email`.
5. Set **Authentication Mode** to **HTTP Header** and paste the token as the **Bearer** token.
6. Click **Test Connector Configuration**, then **Save**.

**CyberArk**

SCIM for CyberArk isn't supported yet. Contact support to enable it. Once it's enabled:

1. In the CyberArk Identity Admin Portal, add a **SCIM Server (SCIM 2.0)** app from the **Web Apps** catalog and save it.
2. Open the app's **Provisioning** settings and enable provisioning.
3. Set the authorisation type to **Authorization Header (OAuth Bearer Token)**.
4. Paste the SCIM URL into **SCIM Service URL**, and the token as the bearer token.

### Rotate the SCIM token

With manual setup, click **Rotate token** to issue a new token. The current token is revoked straight away, so provisioning stops until you paste the new token into your identity provider. You can rotate the token once SSO is enabled.

> [!TIP]
>
> Treat the SCIM token like a password. If it leaks, rotate it and update your identity provider.

### Still on ThreatAware 3.2?

> **SSO on ThreatAware 3.2**
>
> On ThreatAware 3.2, only Microsoft Entra ID is self-service. Okta and other SAML 2.0 / OIDC providers are set up by ThreatAware: contact your account team with your tenant details. SCIM isn't available.
>
> **Entra ID setup (3.2)**
>
> A Global Admin must authorise the setup application.
>
> 1. Go to **Settings → Single Sign-On** and click **Enable Single Sign-On**.
> 2. Click **Authorize**, sign in to Microsoft as a Global Admin and consent.
> 3. Wait 30 seconds for the setup application to propagate.
> 4. Click **Enable** in stage 2. ThreatAware creates the SSO Enterprise Application in your tenant.
> 5. Existing ThreatAware users whose `mail` attribute matches a user in Entra ID get SSO automatically.
>
> **Managing users (3.2)**
>
> * Add users at [Settings → Users](https://docs.threataware.com/settings/users.md) and tick **Enable SSO**. Removing a user, or turning SSO off for them, removes them from the Entra ID application.
> * Break-glass accounts without SSO are supported.
> * **Auto-provisioning** (group-based access from Entra ID) is turned on by ThreatAware support. Assigned users are created with the **Limited Viewer** role, and an admin upgrades them afterwards.

## Next steps

> **[Access Control](https://docs.threataware.com/access-control.md)**
>
> Roles, teams and what each role can see

> **[Settings → Users](https://docs.threataware.com/settings/users.md)**
>
> Manage users, including those provisioned by SSO

> **[Settings → Roles](https://docs.threataware.com/settings/roles.md)**
>
> Choose the Default user role


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.