> For the complete documentation index, see [llms.txt](https://docs.cybus.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybus.io/2-6-0/access/user-management/single-sign-on-sso.md).

# Single Sign-On (SSO)

With single sign-on (SSO), Connectware delegates authentication to your organization's identity provider. Users log in with their existing corporate accounts instead of a separate Connectware password, and Connectware creates or updates a local user for them on first login.

## When to Use SSO

SSO makes sense when:

* Your organization already has a central identity provider (Microsoft Entra ID, Active Directory, or an LDAP-compatible directory).
* You want to enforce your organization's existing password policies and account lifecycle management centrally.
* Users should not need a separate Connectware password.
* You need to automatically provision or revoke access when someone joins or leaves a team.

Local username/password accounts remain available alongside SSO. You can run both at the same time — for example, keeping a local `admin` account as a fallback while all other users authenticate through SSO.

{% hint style="info" %}
Connectware's built-in [multi-factor authentication](/2-6-0/access/user-management/multi-factor-authentication.md) is available for local and LDAP users, but not for Microsoft Entra ID users. For Entra ID, enforce MFA at the identity provider instead.
{% endhint %}

## Choosing a Provider

Connectware supports the following SSO providers:

| Provider                                                                                              | Best for                                                                 |
| ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| [Microsoft Entra ID](/2-6-0/access/user-management/single-sign-on-sso/sso-with-microsoft-entra-id.md) | Organizations using Microsoft 365 or Azure Active Directory              |
| [LDAP](/2-6-0/access/user-management/single-sign-on-sso/sso-with-ldap.md)                             | Organizations with an on-premises Active Directory or OpenLDAP directory |

Both providers support automatic role assignment — you map identity provider groups to Connectware roles, so access is granted and revoked automatically based on group membership.

## How User Accounts Work with SSO

When a user logs in through SSO for the first time, Connectware creates a local user account for them automatically. On each subsequent login, Connectware synchronizes their role assignments from the identity provider.

SSO users appear in the **Users View** alongside local users. Their roles are managed through the identity provider — you cannot change their roles from within Connectware while SSO is active.

If you remove an SSO user from the identity provider, they can no longer log in. Their local Connectware user account remains but is effectively locked out. You can delete the local account from the **Users View** if needed — this only removes the local record and does not affect the identity provider.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cybus.io/2-6-0/access/user-management/single-sign-on-sso.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.