SSO federation availability
Organization self-service SSO federation is not available in the current product version. An Org Admin cannot yet add an organization-specific Microsoft Entra or Okta connection in VaultPAM.
VaultPAM environments can use a platform-configured Microsoft Entra sign-in connection through Keycloak. Use the existing Sign in with Microsoft action. This connection is managed by the VaultPAM platform operator and is not customer-specific. Do not request or use access to the shared Keycloak administration console.
What to expect when customer SSO is released
The customer-SSO release will keep the existing login screen and its Sign in with Microsoft action. It will not add a business-email form, a customer login URL or an organization chooser. VaultPAM will route Microsoft sign-in automatically after Microsoft identifies the tenant. During that automatic handoff, Microsoft may require a password or MFA under the customer's tenant policy; this is a Microsoft authentication challenge, not a VaultPAM organization-selection step.
Before users can sign in through a customer connection, the Org Admin must configure the customer Entra applications, grant tenant-wide consent separately for the VaultPAM discovery application and the customer SSO application, select access groups and map those groups to VaultPAM roles. Microsoft sign-in alone will not grant access. V1 grants customer access only to tenant-local internal users in selected groups; external/B2B identities, including external users represented as Member, are not supported. Users without eligible local membership will be directed to contact their organization administrator.
Directory Sync is separate from SSO
The Organization → Directory Sync setup connects a dedicated Microsoft Entra application to Microsoft Graph. It reads users and selected groups for directory synchronization. The Tenant ID, Application ID and client secret entered there do not configure Microsoft sign-in and are not copied to Keycloak.
Use a dedicated Entra application for Directory Sync. Do not reuse an interactive SSO application.
What you can do now
- Configure Microsoft Entra Directory Sync and group-to-role mappings if the feature is enabled for your organization.
- Use the existing Sign in with Microsoft action when your VaultPAM operator has configured and approved it for the environment.
- Contact VaultPAM support if your organization requires its own Entra tenant federation.
Not currently supported as customer self-service
- organization-specific Microsoft Entra SSO configuration or Entra admin-consent workflow;
- Okta federation from the VaultPAM UI;
- customer access to the shared Keycloak realm.
These limitations remain until the organization-scoped SSO onboarding flow has been implemented, security-tested and deployed. This article will be replaced with the actual setup procedure only after that release.