Skip to main content

​
Dashboard Authentication Setup

Configure Single Sign-On (SSO) for your Risotto dashboard to enable secure, seamless authentication using your organization’s existing identity provider.
Contact Risotto Support: SSO configuration requires enablement by Risotto support. Contact your account representative or support@tryrisotto.com to activate SSO for your organization before beginning setup.

​
Prerequisites

Before configuring SSO, ensure you have:
  • Administrative access to your identity provider
  • SSO enabled by Risotto support team
Who this affects. Dashboard SSO only applies to the admins and agents who sign in to the Risotto dashboard. Employees who request help through Slack or Microsoft Teams never sign in to Risotto, so they are already covered by your identity provider’s own login and MFA. You can set up dashboard SSO at any point, including during a pilot; there is no need to wait for go-live.

​
Supported Identity Providers

​
Overview

Configure SAML-based authentication using Okta Workforce Identity to allow your users to sign into the Risotto dashboard with their Okta credentials.

​
Supported Features

The Risotto SAML integration supports SP-initiated SSO. Users sign in from the Risotto dashboard and are redirected to Okta to authenticate.IdP-initiated SSO (launching Risotto from the Okta dashboard tile) is off by default. If your team wants it, ask Risotto Support to enable it when you share your metadata in Step 4. Without it, the Okta tile returns a RelayState parameter is missing error.

​
Step 1: Request Risotto Support to Enable SSO

  1. Reach out to Risotto Support and request to enable Dashboard SSO via Okta.
  2. Risotto Support will provide your risotto_org_id.
Your risotto_org_id is the ID of the SSO connection that Risotto creates for your organization. It is not your Okta domain, and it is not the organization ID that the Risotto dashboard shows. It starts with samlc_. Okta uses it to link the Risotto catalog app to your account. You enter this value when adding the app in Step 2, so keep it on hand.

​
Step 2: Add the Risotto App from the Okta Catalog

  1. Sign in to your Okta Admin Console
  2. Navigate to Applications > Applications
  3. Click Browse App Catalog
  4. Search for Risotto and select it from the results
  5. Click Add Integration
  6. In the app’s configuration settings, enter the risotto_org_id that Risotto Support provided in Step 1. Okta labels this field SAML Org ID
Aside from your risotto_org_id, the Risotto catalog integration is preconfigured with all required SAML settings, attribute statements, and Name ID format. There is no other manual SAML configuration to complete — you only need to share your metadata with Risotto (see Step 4).

​
Step 3: Assign Users and Groups

  1. Navigate to the Assignments tab of your Risotto app
  2. Click Assign > Assign to Groups or Assign to People
  3. Select the users/groups who should have access to Risotto
  4. Click Done

​
Step 4: Share Metadata URL with Risotto Support

  1. In Okta, go to the Sign On tab of your Risotto app
  2. Copy the Metadata URL from the SAML setup instructions
  3. Share the Metadata URL with the Risotto team
  4. Request the Risotto team to enforce SSO for your organization

​
Testing

Test the integration by:
  1. Opening an incognito/private browser window
  2. Navigating to your Risotto dashboard
  3. Clicking Sign in with Okta
  4. Verifying successful authentication and access

​
Overview

Google Workspace offers two authentication methods for the Risotto dashboard: Sign in with Google (OAuth) for simple setups, or SAML for enterprise requirements.Best for: Organizations wanting quick setup with Google OAuth
  1. Contact Risotto Support and request Google sign-in for the Risotto dashboard.
  2. Share your Google Workspace domain with Risotto Support.
  3. Risotto Support sets up and enables the connection.
Benefits of OAuth:
  • Automatic user provisioning
  • Built-in MFA support through Google
  • No certificate management required

​
Option 2: Google SAML Configuration

Best for: Organizations requiring SAML compliance or advanced attribute mapping

​
Step 1: Request a SAML Connection from Risotto

  1. Contact Risotto Support and request a Google SAML connection.
  2. Share your email domain with Risotto Support.
  3. Risotto Support creates the connection and sends you the Single Sign-On URL and Audience URI.

​
Step 2: Configure SAML App in Google Admin

  1. Sign in to your Google Admin Console
  2. Navigate to Apps > Web and mobile apps
  3. Click Add app > Add custom SAML app
App Details:
  • App name: Risotto Dashboard
  • Description: SSO access to Risotto IT automation platform
Google Identity Provider Details:
  • Download the certificate and note the SSO URL
Service Provider Details:
  • ACS URL: Use Single Sign-On URL from Risotto
  • Entity ID: Use Audience URI from Risotto
  • Start URL: Leave blank
  • Signed response: Checked
  • Name ID: Basic Information > Primary email
Attribute Mapping:

​
Step 3: Complete Configuration

  1. Send the Google SAML certificate and the Google SSO URL to Risotto Support.
  2. Risotto Support completes and enables the connection.

​
Overview

Configure SAML-based authentication using Microsoft Entra ID (formerly Azure AD) to enable secure dashboard access for your organization.

​
Step 1: Request a SAML Connection from Risotto

  1. Contact Risotto Support and request a Microsoft Entra ID SAML connection.
  2. Share your email domain with Risotto Support.
  3. Risotto Support creates the connection and sends you the Single Sign-On URL and Audience URI.

​
Step 2: Configure Enterprise Application in Entra ID

  1. Sign in to the Azure Portal
  2. Navigate to Microsoft Entra ID > Enterprise Applications
  3. Click New application > Create your own application
  4. Name it Risotto Dashboard and select Integrate any other application
Single Sign-On Configuration:
  1. Select SAML as the SSO method
  2. Click Edit in the Basic SAML Configuration section
Basic SAML Configuration:
  • Identifier (Entity ID): Use Audience URI from Risotto
  • Reply URL (Assertion Consumer Service URL): Use Single Sign-On URL from Risotto
  • Sign on URL: Your Risotto dashboard URL
  • Relay State: Leave blank
User Attributes & Claims:

​
Step 3: Assign Users and Groups

  1. Navigate to Users and groups in your Enterprise Application
  2. Click Add user/group
  3. Select users or groups that should have Risotto access
  4. Click Assign

​
Step 4: Complete Risotto Configuration

  1. In Azure, go to Single sign-on > SAML Certificates
  2. Download the Certificate (Base64)
  3. Copy the Login URL
  4. Send the certificate and the Login URL to Risotto Support.
  5. Risotto Support completes and enables the connection.

​
User Management

​
Provisioning

Risotto does not create accounts automatically through SSO — Just-In-Time (JIT) provisioning is not supported. Users must already have a Risotto account before they can sign in, so invite them to your Risotto organization first. Once a user exists, SSO matches them by email address and signs them in with their existing Risotto profile and permissions. SCIM provisioning is not supported. Manage dashboard users from the Risotto dashboard; see Invite Users.
Recommended order: create your Risotto organization and invite your dashboard users first (email or Google sign-in is fine to start), then layer SSO on top. Ask Risotto Support to enforce SSO-only sign-in once everyone has tested it.

​
Deprovisioning

Account Suspension: Users removed from SSO assignments in your identity provider will lose access to Risotto. Ensure proper coordination between identity management and Risotto administration.