Cadres IT Operations & Infrastructure
Products Architecture Docs Blog
Sheet POR-05 Rev 2026.08
Start Trial

Sheet POR-05 · Identity Manual

Federation Operations

Connecting upstream identity providers, routing sign-in, resolving account links and rolling out policy.

Audience: Identity administrators Focus: Federation setup and upkeep

Scope

How to connect an upstream identity provider, route users to it, resolve account links and keep keys and certificates current.

Adding a connection

Work through the SSO & Federation stages in order: Overview, Setup, Routing & Verify, Links & Reviews and Advanced Operations.

  1. In Setup, create the connection. It starts as Generic OIDC. Choose Entra ID, Okta or Generic SAML under Provider type if you need one of those.
  2. For SAML, you can import the provider’s metadata XML. Portal shows a preview and fills in the fields for you to check. Importing never enables the provider.
  3. Test the connection. A passing test checks the protocol setup only. It does not route anyone.
  4. In Routing & Verify, add a rule for who signs in through the connection and run a routing simulation.
  5. Enable the connection from the connection list, then enable the rule.

Every provider endpoint must use HTTPS. Portal rejects local and private network addresses.

When Portal cannot link a federated sign-in to a Portal user on its own, the case goes to Links & Reviews.

  • Resolve the review queue before you move more users onto a connection.
  • Select Reconcile on a link to recompute it now. Portal also reconciles stale links on a schedule.
  • Portal never creates a user from an unverified email claim. Fix the claim at the provider, or create the user first and link the account by hand.

First sign-in for new federated users

Users created on their first federated sign-in must enroll an authenticator app before they can do anything else. This gives them a way into Portal if the upstream provider is down. A tenant can turn the requirement off if its provider already enforces strong MFA.

Keys, certificates and bundles

Rotate secrets and certificates before the expiry warning window closes. Handle configuration bundles that include secrets as credentials.

Rolling out policy across tenants

From an operator tenant, Fleet Policy Rollout applies a small set of sign-in settings to many customer tenants at once: just-in-time provisioning, linking by email, trusting upstream MFA, minimum authentication strength and Portal step-up.

  1. Choose a template and the target tenants.
  2. Run Preview Fleet Rollout and review every tenant, including warnings and skips.
  3. Apply. Portal blocks the apply until a current preview exists.

A rollout changes existing settings only. It does not create providers or rules, and it does not copy client IDs, secrets or tenant-specific endpoints. A skipped tenant needs a fix inside that tenant.

What to watch

  • Repeated sign-in failures from one provider or one set of applications.
  • Policy denials that point to a wrong routing or lifecycle rule.
  • Certificate, key or metadata changes at the provider.
  • A rising count of link reviews during a cutover.