Set up admin SSO

Administrators sign in separately from the people whose agents connect, so their sign-in has its own setup. You configure it in SecureAuth Connect's Admin workspace, then grant console access with a role in Agent Authority. End users sign in through the Agentic AI workspace instead; see Identity and sign-in.

Before you beginCopy Anchor Link

• You need the Tenant Admin role in SecureAuth Connect to change how administrators sign in.
• Granting the admin role in Agent Authority needs the admin role yourself. See Roles.

Choose how administrators sign inCopy Anchor Link

1. In SecureAuth Connect, select the gear icon at the top right, then Tenant Settings › Account.
2. In the left sidebar, select Account › Sign-in and SSO.
3. Under SecureAuth, set the login methods administrators can use. To configure more methods, select the three dots next to SecureAuth, then Configure.

Sign administrators in with your identity providerCopy Anchor Link

To let administrators sign in with the account they use everywhere else, connect your identity provider to the Admin workspace:

1. On Tenant Settings › Account, select Open Admin Workspace when prompted. It opens the Admin workspace's Identity Providers page.
2. Add your OIDC or SAML provider, such as Okta or Microsoft Entra ID. For each provider's steps, see Identity providers in the SecureAuth Connect documentation.

If your tenant has advanced administrator management turned on, administrators live in the built-in Administrators identity pool. Open it from the Built in Admin provider with Manage Pool. See Manage tenant administrators.

Invite an administratorCopy Anchor Link

1. On Tenant Settings › Account, select Invite Admin.
2. Enter the person's email and name.
3. Under Tenant role, select Member, choose the Agentic AI workspace, and pick Workspace Admin for full access or Workspace Auditor for read-only access.

The person gets an invitation email, and their account is active once they accept it.

Give them the admin role in the consoleCopy Anchor Link

A Connect workspace role doesn't grant anything in Agent Authority by itself. After the person signs in for the first time, give them a console role:

1. In Agent Authority, open Inventory › Human Identities, and select the person on the Users tab.
2. Select Add role in their header, and choose admin, or viewer for read-only access.

The role applies at once. See Roles for custom roles that grant less than full access.

Next stepsCopy Anchor Link

Your administrators now sign in with the method you chose, and the people you gave the admin role can manage the console. Next, decide what each administrator can change with a custom role.

• Roles – the built-in roles, and custom roles with narrower permissions
• Identity and sign-in – how end users sign in to connect their agents