Configuring identity providers

---

Choosing the identity provider for your organization affects the way users sign in, and how user and group accounts are created and managed for Automation Suite.

Models

While we offer several authentication settings for you to control access to your instance of Automation Suite, they are all based on two main models: the default model and the Azure Active Directory (Azure AD) model, which lets you leverage more advanced identity management capabilities.

Allow any user to sign in using basic authentication (Default model)

With this model, organization administrators create user accounts for employees in Automation Suite so that they can log in.
The accounts that are created may represent a local account in Automation Suite, or a user in the external directory provider configured at the host level (as documented in Host authentication and security settings.)

Enable enterprise SSO with Microsoft Azure Active Directory (Azure Active Directory model)

The integration with Azure Active Directory (Azure AD) can offer scalable user and access management for your organization, allowing for compliance across all the internal applications used by your employees. If your organization is using Azure AD or Office 365, you can connect your Automation Suite organization directly to your Azure AD tenant to obtain the following benefits:

📘

Note:

While on the Azure AD model, you can continue to use all the features of the default model. But to maximize the benefits, we recommend relying exclusively on centralized account management from Azure AD.

If you would like to use Azure Active Directory as the identity provider for your organization, follow the instructions in Setting up the Azure AD integration.

SAML model

This model allows you to connect Automation Suite to your chosen identity provider (IdP) so that:

• your users can benefit from single sign-on (SSO) and
• you can manage existing accounts from your directory in Automation Suite, without having to re-create identities.

Automation Suite can connect to any external identity provider that uses the SAML 2.0 standard.

Benefits

Setup

Administrators can configure and enable the SAML integration for your entire organization.
For instructions, see Configuring the SAML integration.

Transitioning from the Azure AD integration to the SAML integration

After switching to the SAML integration, the Azure AD integration is disabled. Azure AD group assignments no longer apply, so Automation Suite group membership and the permissions inherited from Azure AD are no longer respected.

 

Allowing or restricting basic authentication

Basic authentication, or basic sign-in, refers to signing in with the username and password of a local account.

If basic authentication is restricted, your users can only log in with their directory account, as defined in the external identity provider. Otherwise, users can log in with both their local accounts, if any, and their directory accounts.

Also see Configuration levels and inheritance for more information about this setting.

Setting basic authentication at the organization level

This setting is only available if an external provider integration is enabled at the host or organization level.

When set at the organization level, the setting applies to all accounts in the organization.
For exceptions, basic authentication can also be set at the account level where you want this setting to apply differently.

To allow or restrict basic authentication for your organization:

1. Log in to the organization-level Management portal at https://<server>/identity/management as an organization administrator.
2. Go to Admin and make sure that the organization is selected at the top of the left pane.
3. Click Security.
   The Security Settings page for the organization opens on the Authentication Settings tab.
4. Click the Basic sign-in toggle to restrict or allow sign in using basic authentication:
   • If on (right toggle position, blue toggle), basic authentication is allowed.
   • If on (left toggle position, gray toggle), basic authentication is restricted.
5. At the bottom-right, click Save to apply your changes.

Old admin experience

If you are still using the old admin experience, follow these instructions instead:

1. Log in to the organization-level Management portal at https://<server>/identity/management as an organization administrator.
2. Go to Admin and select Security Settings.
3. Under External Providers, click the Disable basic authentication for the organizations toggle to restrict or allow sign in using basic authentication:
   • If off (left toggle position, gray toggle), basic authentication is allowed.
   • If on (right toggle position, blue toggle), basic authentication is restricted.
4. At the bottom-right of the External Providers section, click Save to apply your changes.

 

Configuring security options

---

To configure security options for your organization, go to Admin > organization > Security and, under Basic sign-in, click Edit password policy, where you can edit the options as needed.
If you are still using the old admin experience, go to Admin and select Security Settings on the left. The options are displayed in the Security section.

Password complexity

📘

Editing the Password complexity settings does not affect existing passwords.

Account lockout