Required Roles: All
Required Permissions: Workspace Manager
Introduction
Single sign-on (SSO) allows users to authenticate to Kivo using their corporate identity provider, eliminating the need for separate usernames and passwords. This article provides a high-level overview of how SSO works, the security benefits, and the identity providers Kivo supports.
Overview
SSO centralizes authentication with your organization’s identity provider (IdP), allowing users to log in once and securely access Kivo using their existing corporate credentials.
With SSO enabled:
Passwords are not stored or managed in Kivo
Authentication is handled by your IdP
Access control and user lifecycle are governed by your organization
Key benefits include:
Improved security posture
Reduced password management
Consistent login experience across applications
Centralized access control and deprovisioning
How SSO Works in Kivo
Kivo acts as the Service Provider (SP), while your organization manages the Identity Provider (IdP).
The authentication flow is:
A user initiates login in Kivo
Kivo redirects the user to your IdP
The IdP authenticates the user
The IdP returns a signed authentication response to Kivo
Kivo validates the response and grants access
Kivo does not support IdP-initiated login flows for security reasons. All authentication must begin from the Kivo login page.
Supported Identity Providers
Kivo supports SSO through SAML 2.0 and OAuth-based providers, including:
Microsoft Entra ID (formerly Azure Active Directory)
Google Workspace
Okta
Auth0
CyberArk
Other SAML 2.0–compliant identity providers
All providers must return a valid email address as the user identifier.
Security and Compliance Considerations
Authentication is handled entirely by your IdP
Kivo validates signed authentication assertions
User access is tied to identity and group membership
Deprovisioning users at the IdP level prevents future access
SSO supports compliance with common security and GxP expectations
When to Use SSO
SSO is recommended when:
You want centralized access control
You manage users through an IT team
You need consistent authentication policies (MFA, conditional access)
You want simplified onboarding and offboarding