SSO and User Groups

This section is for the person who administers your Identity Provider (IdP) — Microsoft Entra ID, Okta, Google Workspace, or another. It covers how to connect your IdP to Intric so your users sign in with the accounts they already have.

How login works

Your users never create a separate Intric password. Sign-in goes through three parties:

1. Your IdP — your organization’s Entra ID, Okta, Google Workspace, or similar — authenticates the user and confirms who they are.
2. Intric’s login service, at login.intric.ai, receives that confirmation and issues a session for Intric. It’s built on Zitadel, an open-source identity platform; day to day, you only ever interact with it as login.intric.ai.
3. Intric trusts the session and signs the user in, linking it to their account by email address.

Your IdP never talks to Intric directly — it talks to login.intric.ai, which is why the configuration on your side always points there, whichever IdP you use.

Running Intric on your own servers

If your installation is fully self-hosted with your own identity provider rather than through Intric’s hosted login service, your users’ IdP points at your own login host instead of login.intric.ai. The callback path is the same, /idps/callback, just on your own domain — check the Callback URL field shown on your IdP’s configuration page to confirm it. Everything else on these pages applies unchanged.

Choose your path

• Microsoft Entra ID (Azure AD) — the most common choice, and the one with a full click-by-click walkthrough. See Entra ID setup.
• Another OIDC provider — Okta, Google Workspace, Keycloak, ADFS, or anything else that speaks OpenID Connect. See Other identity providers.
• SAML 2.0 — possible, but it needs attribute mapping set up together with Intric rather than a self-serve guide. Contact Intric support; see Other identity providers for what to have ready.

Once SSO is live, see User groups for how group membership controls access to Spaces, and Troubleshooting if a login isn’t working.

How setup goes, end to end

1. You prepare. Create the application in your IdP and gather the values Intric needs — the checklist below, or the filled-in version on your provider’s page.
2. You send it to us, through a secure channel agreed with Intric support — never by plain email, since this includes a client secret.
3. We configure it on Intric’s side and confirm it’s ready.
4. We do a joint pilot login with one test user from your organization, so any issue surfaces before anyone else is switched over.
5. You roll it out to the rest of your users.

What you send us

At minimum, whichever IdP you use:

• Issuer URL, or for Entra ID the Directory (tenant) ID (we derive the issuer from it)
• Client ID
• Client secret — the secret value, not its ID — and its expiry date
• If you’re using groups: the group name → identifier mapping for the groups Intric should know about, so we can give the groups readable names in Intric
• The email address of one pilot test user
• The address your users open Intric at (for example https://yourorg.intric.ai)
• A technical contact for secret expiry and future changes

Entra ID setup

Entra ID: exact fields and a ready-to-fill template

Read more