> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryrisotto.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dashboard Authentication Setup

> Configure Single Sign-On (SSO) for your Risotto dashboard using enterprise identity providers

# Dashboard Authentication Setup

Configure Single Sign-On (SSO) for your Risotto dashboard to enable secure, seamless authentication using your organization's existing identity provider.

<Tip>
  **Contact Risotto Support**: SSO configuration requires enablement by Risotto
  support. Contact your account representative or
  [support@tryrisotto.com](mailto:support@tryrisotto.com) to activate SSO for
  your organization before beginning setup.
</Tip>

## Prerequisites

Before configuring SSO, ensure you have:

* **Administrative access** to your identity provider
* **SSO enabled** by Risotto support team

<Info>
  **Who this affects.** Dashboard SSO only applies to the admins and agents who
  sign in to the Risotto dashboard. Employees who request help through Slack or
  Microsoft Teams never sign in to Risotto, so they are already covered by your
  identity provider's own login and MFA. You can set up dashboard SSO at any
  point, including during a pilot; there is no need to wait for go-live.
</Info>

## Supported Identity Providers

<AccordionGroup>
  <Accordion title="Okta SAML Configuration">
    ### Overview

    Configure SAML-based authentication using Okta Workforce Identity to allow your users to sign into the Risotto dashboard with their Okta credentials.

    ### Supported Features

    The Risotto SAML integration supports **SP-initiated SSO**. Users sign in from the Risotto dashboard and are redirected to Okta to authenticate.

    **IdP-initiated SSO** (launching Risotto from the Okta dashboard tile) is off by default. If your team wants it, ask Risotto Support to enable it when you share your metadata in Step 4. Without it, the Okta tile returns a `RelayState parameter is missing` error.

    ### Step 1: Request Risotto Support to Enable SSO

    1. Reach out to [Risotto Support](mailto:support@tryrisotto.com) and request to enable Dashboard SSO via Okta.
    2. Risotto Support will provide your **`risotto_org_id`**.

    Your `risotto_org_id` is the ID of the SSO connection that Risotto creates for your organization. It is not your Okta domain, and it is not the organization ID that the Risotto dashboard shows. Okta uses it to link the Risotto catalog app to your account. You enter this value when adding the app in Step 2, so keep it on hand.

    ### Step 2: Add the Risotto App from the Okta Catalog

    1. Sign in to your **Okta Admin Console**
    2. Navigate to **Applications** > **Applications**
    3. Click **Browse App Catalog**
    4. Search for **Risotto** and select it from the results
    5. Click **Add Integration**
    6. In the app's configuration settings, enter the **`risotto_org_id`** that Risotto Support provided in Step 1

    Aside from your `risotto_org_id`, the Risotto catalog integration is preconfigured with all required SAML settings, attribute statements, and Name ID format. There is no other manual SAML configuration to complete — you only need to share your metadata with Risotto (see Step 4).

    ### Step 3: Assign Users and Groups

    1. Navigate to the **Assignments** tab of your Risotto app
    2. Click **Assign** > **Assign to Groups** or **Assign to People**
    3. Select the users/groups who should have access to Risotto
    4. Click **Done**

    ### Step 4: Share Metadata URL with Risotto Support

    1. In Okta, go to the **Sign On** tab of your Risotto app
    2. Copy the **Metadata URL** from the SAML setup instructions
    3. Share the **Metadata URL** with the Risotto team
    4. Request the Risotto team to enforce SSO for your organization

    ### Testing

    Test the integration by:

    1. Opening an incognito/private browser window
    2. Navigating to your Risotto dashboard
    3. Clicking **Sign in with Okta**
    4. Verifying successful authentication and access
  </Accordion>

  <Accordion title="Google Workspace Configuration">
    ### Overview

    Google Workspace offers two authentication methods for the Risotto dashboard: **Sign in with Google** (OAuth) for simple setups, or **SAML** for enterprise requirements.

    ### Option 1: Sign in with Google (Recommended)

    **Best for**: Organizations wanting quick setup with Google OAuth

    1. Contact [Risotto Support](mailto:support@tryrisotto.com) and request Google sign-in for the Risotto dashboard.
    2. Share your **Google Workspace domain** with Risotto Support.
    3. Risotto Support sets up and enables the connection.

    **Benefits of OAuth**:

    * Automatic user provisioning
    * Built-in MFA support through Google
    * No certificate management required

    ### Option 2: Google SAML Configuration

    **Best for**: Organizations requiring SAML compliance or advanced attribute mapping

    ### Step 1: Request a SAML Connection from Risotto

    1. Contact [Risotto Support](mailto:support@tryrisotto.com) and request a Google SAML connection.
    2. Share your **email domain** with Risotto Support.
    3. Risotto Support creates the connection and sends you the **Single Sign-On URL** and **Audience URI**.

    ### Step 2: Configure SAML App in Google Admin

    1. Sign in to your **Google Admin Console**
    2. Navigate to **Apps** > **Web and mobile apps**
    3. Click **Add app** > **Add custom SAML app**

    **App Details:**

    * **App name**: `Risotto Dashboard`
    * **Description**: `SSO access to Risotto IT automation platform`

    **Google Identity Provider Details:**

    * Download the **certificate** and note the **SSO URL**

    **Service Provider Details:**

    * **ACS URL**: Use Single Sign-On URL from Risotto
    * **Entity ID**: Use Audience URI from Risotto
    * **Start URL**: Leave blank
    * **Signed response**: Checked
    * **Name ID**: Basic Information > Primary email

    **Attribute Mapping:**

    | Google Directory attributes | App attributes |
    | - | - |
    | Primary email | mail |
    | First name | firstName |
    | Last name | lastName |

    ### Step 3: Complete Configuration

    1. Send the Google SAML **certificate** and the Google **SSO URL** to Risotto Support.
    2. Risotto Support completes and enables the connection.
  </Accordion>

  <Accordion title="Microsoft Entra ID Configuration">
    ### Overview

    Configure SAML-based authentication using Microsoft Entra ID (formerly Azure AD) to enable secure dashboard access for your organization.

    ### Step 1: Request a SAML Connection from Risotto

    1. Contact [Risotto Support](mailto:support@tryrisotto.com) and request a Microsoft Entra ID SAML connection.
    2. Share your **email domain** with Risotto Support.
    3. Risotto Support creates the connection and sends you the **Single Sign-On URL** and **Audience URI**.

    ### Step 2: Configure Enterprise Application in Entra ID

    1. Sign in to the **Azure Portal**
    2. Navigate to **Microsoft Entra ID** > **Enterprise Applications**
    3. Click **New application** > **Create your own application**
    4. Name it `Risotto Dashboard` and select **Integrate any other application**

    **Single Sign-On Configuration:**

    1. Select **SAML** as the SSO method
    2. Click **Edit** in the Basic SAML Configuration section

    **Basic SAML Configuration:**

    * **Identifier (Entity ID)**: Use Audience URI from Risotto
    * **Reply URL (Assertion Consumer Service URL)**: Use Single Sign-On URL from Risotto
    * **Sign on URL**: Your Risotto dashboard URL
    * **Relay State**: Leave blank

    **User Attributes & Claims:**

    | Claim name | Source attribute |
    | - | - |
    | `emailaddress` | `user.mail` |
    | `givenname` | `user.givenname` |
    | `surname` | `user.surname` |

    ### Step 3: Assign Users and Groups

    1. Navigate to **Users and groups** in your Enterprise Application
    2. Click **Add user/group**
    3. Select users or groups that should have Risotto access
    4. Click **Assign**

    ### Step 4: Complete Risotto Configuration

    1. In Azure, go to **Single sign-on** > **SAML Certificates**
    2. Download the **Certificate (Base64)**
    3. Copy the **Login URL**
    4. Send the **certificate** and the **Login URL** to Risotto Support.
    5. Risotto Support completes and enables the connection.
  </Accordion>
</AccordionGroup>

## User Management

### Provisioning

Risotto does not create accounts automatically through SSO — Just-In-Time (JIT) provisioning is not supported. Users must already have a Risotto account before they can sign in, so invite them to your Risotto organization first. Once a user exists, SSO matches them by email address and signs them in with their existing Risotto profile and permissions.

SCIM provisioning is not supported. Manage dashboard users from the Risotto dashboard; see [Invite Users](/guides/invite-users).

<Tip>
  Recommended order: create your Risotto organization and invite your dashboard
  users first (email or Google sign-in is fine to start), then layer SSO on top.
  Ask Risotto Support to enforce SSO-only sign-in once everyone has tested it.
</Tip>

### Deprovisioning

<Warning>
  **Account Suspension**: Users removed from SSO assignments in your identity
  provider will lose access to Risotto. Ensure proper coordination between
  identity management and Risotto administration.
</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.