Skip to content
KaDeep Docsv4.0
Open StudioDownload

Sign-in and security

For admins2 min readUpdated for v4.0

Your view

Decide how people sign in: with your company’s single sign-on, with a password plus a second step, or both. One page holds it all.

1. Open Sign-in & security

Section titled “1. Open Sign-in & security”
In the sidebar, open Workspace › Security & Audit. The Sign-in & security tab opens.
Press Ctrl K (Windows) or ⌘ K (Mac), type Sign-in and press Enter.
Sign-in & security: Fix first, Require multi-factor sign-in, Grace period and Who is set up (Manage view)
Sign-in & security: Fix first, Require multi-factor sign-in, Grace period and Who is set up (Manage view)

Manage view

Sign-in & security: Fix first, Require multi-factor sign-in, Grace period and Who is set up (Hands-on view)
Sign-in & security: Fix first, Require multi-factor sign-in, Grace period and Who is set up (Hands-on view)

Hands-on view

1 Fix first lists the gaps that matter most, each with a button to fix it.

2. Require two-step sign-in

Section titled “2. Require two-step sign-in”
  1. Turn on 2 Require multi-factor sign-in.
  2. Choose a 3 Grace period: how long people have to set it up.
  3. Watch 4 Who is set up fill up.

People then add an authenticator app or a passkey in Profile & account. People who use single sign-on are covered by your identity provider.

3. Turn on single sign-on

Section titled “3. Turn on single sign-on”

KaDeep works with Okta, Microsoft Entra ID, Google Workspace or any OpenID Connect provider.

Single sign-on (OIDC): issuer URL, client ID and secret, email domains, the role for new people, and Allow sign-in with SSO (Manage view)
Single sign-on (OIDC): issuer URL, client ID and secret, email domains, the role for new people, and Allow sign-in with SSO (Manage view)

Manage view

Single sign-on (OIDC): issuer URL, client ID and secret, email domains, the role for new people, and Allow sign-in with SSO (Hands-on view)
Single sign-on (OIDC): issuer URL, client ID and secret, email domains, the role for new people, and Allow sign-in with SSO (Hands-on view)

Hands-on view

  1. Copy the Redirect URI and add it to a new app in your identity provider.
  2. Paste the 1 Issuer URL, Client ID and Client secret from that app.
  3. Type your company’s 2 Email domains.
  4. Choose the 3 role for people signing in the first time.
  5. Turn on 4 Allow sign-in with SSO, then choose Save single sign-on.

People from those domains now see Sign in with SSO on the sign-in page.

4. Limit sessions

Section titled “4. Limit sessions”
Session limits: Sign out after no activity, and Longest a session can last (Manage view)
Session limits: Sign out after no activity, and Longest a session can last (Manage view)

Manage view

Session limits: Sign out after no activity, and Longest a session can last (Hands-on view)
Session limits: Sign out after no activity, and Longest a session can last (Hands-on view)

Hands-on view

Choose 1 how long a session can sit unused, and 2 how long any session can last. Then choose Save session limits. An agent still working counts as use.

5. Add people automatically (SCIM)

Section titled “5. Add people automatically (SCIM)”

Further down, User provisioning (SCIM) lets Okta or Microsoft Entra ID add and remove people for you. Choose New SCIM token, then paste the base URL and token into your identity provider. Choose whether people removed there are suspended or removed here.

What’s next

Section titled “What’s next”
Tokens and connectionsEvery token, its owner and expiry.
Sign-in problemsHelp for people who can't get in.
Set up checklistBack to the list.