As a Kroo administrator, open Settings > Company to configure SSO. Choose your identity provider and enter the required values using the steps below.
Don’t see SSO settings after logging in? Confirm your account has the Admin role. Contact implementations@getkroo.com if you need help with access or run into any issues during setup.
Microsoft Entra ID
Okta
Duo Security
Use these steps to configure Microsoft Entra ID as your SSO provider.
1
Configure API permissions in Microsoft Entra
Configure your Microsoft Entra app registration to allow the required OIDC scopes: openid, email, and profile.In your Microsoft Entra app registration, grant the required Microsoft Graph API permissions:
User.Read: Allows Kroo to read the signed-in user’s basic profile
Directory.Read.All: Allows Kroo to read directory data required for authentication
Your Microsoft Entra administrator may need to grant admin consent after adding these permissions.
2
Add the redirect URI
In the app registration, go to Authentication, add or edit the Web platform, and add this redirect URI:
https://auth.getkroo.com/api/auth/sso/callback
Microsoft sends users back to this URL after a successful login.
3
Create a client secret
In the app registration, go to Certificates & secrets and create a new client secret.
Copy the client secret value immediately. Microsoft Entra will not show it again after you leave the page.
4
Enter Microsoft Entra details in Kroo
In the Kroo app, open your company’s SSO settings and enter:
Verified Domain: The verified email domain users will use to sign in to Kroo, such as yourcompany.com
Provider: Select Microsoft Entra ID OIDC
Issuer: https://login.microsoftonline.com/<tenant-id>/v2.0, using your Microsoft Entra Tenant ID from the app registration overview page. Use the tenant ID GUID, not the qualified tenant name such as yourcompany.onmicrosoft.com
Client ID: Found on the app registration overview page
Client Secret: The secret value generated under Certificates & secrets
Use these steps to configure Okta as your SSO provider.
If your organization does not use the default https://*.okta.com Okta domain format, contact implementations@getkroo.com before setup.
1
Create an Okta app integration
In Okta, create a new OIDC app integration for Kroo.Use Web Application as the application type.Configure the app integration to allow the required OIDC scopes: openid, email, and profile.
2
Add the sign-in redirect URI
In the Okta app integration, add this sign-in redirect URI:
https://auth.getkroo.com/api/auth/sso/callback
Okta sends users back to this URL after a successful login.
3
Assign users or groups
Assign the Kroo Okta app integration to the users or groups that should be able to sign in to Kroo.
4
Enter Okta details in Kroo
In the Kroo app, open your company’s SSO settings and enter:
Verified Domain: The verified email domain users will use to sign in to Kroo, such as yourcompany.com
Provider: Select Okta
Issuer: Your Okta issuer URL, such as https://yourcompany.okta.com
Client ID: Found in the Okta app integration
Client Secret: Generated for the Okta app integration
Use these steps to configure Duo Single Sign-On as your OIDC provider.
1
Create a Duo OIDC application
Configure a working authentication source for Duo Single Sign-On, then add a Generic OIDC Relying Party application for Kroo in the Duo Admin Panel.See Duo’s setup instructions for authentication source and application configuration details.
2
Add the sign-in redirect URL
On the application’s General tab, configure the Authorization Code grant and add this Sign-In Redirect URL:
https://auth.getkroo.com/api/auth/sso/callback
Duo sends users back to this URL after a successful login.
3
Configure scopes and user access
On the Scopes tab, allow all three required OIDC scopes: openid, email, and profile. These scopes are required for all Kroo SSO providers. Confirm the claims map to your users’ names and email addresses.Set User access to allow the users or groups that should be able to sign in to Kroo, then save the application.
4
Enter Duo details in Kroo
In the Kroo app, open your company’s SSO settings and enter:
Verified domains: The email domains users will use to sign in to Kroo, such as yourcompany.com. These are separate from your Duo SSO domain
Provider: Select Duo Security OIDC
Duo SSO domain: Your Duo hostname, such as sso-12345678.sso.duosecurity.com, with or without https://
Client ID: Copy the full value from the Duo application’s Metadata tab
Client secret: Copy the value from the Duo application’s Metadata tab
Kroo builds the issuer as https://<duo-sso-domain>/oidc/<client-id> and discovers the OIDC endpoints automatically. Click Save SSO.
You can also paste the full Issuer URL from Duo’s Metadata tab into Duo SSO domain. Kroo preserves its path instead of appending the Client ID. Use this option if your issuer’s path identifier differs from your Client ID, such as with a multi-client Duo OAuth 2.1 / OIDC setup. Do not include /.well-known/openid-configuration.
5
Update an existing Duo configuration
Leave the client secret blank to keep the existing secret. You can keep the saved full issuer URL and masked Client ID unchanged.If you replace the full issuer URL with a domain-only value, re-enter the full Client ID. Kroo cannot build an issuer from the masked value.
After saving your SSO settings, test sign-in with a user assigned to the identity provider application. Confirm the user can complete the provider login flow and return to Kroo successfully.
Keep an existing Kroo administrator session open while testing SSO so you can update settings if the first attempt fails.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Kroo","colors":{"primary":"#0c7c59","light":"#07C983","dark":"#15803D"},"logo":{"light":"https://dkq5g4kc673o0.cloudfront.net/Kroo%20Logo","dark":"https://dkq5g4kc673o0.cloudfront.net/Kroo%20Logo"},"favicon":"https://mintcdn.com/kroo/Bw1eAmcSMLIYa-Xk/favicon.ico?fit=max\u0026auto=format\u0026n=Bw1eAmcSMLIYa-Xk\u0026q=85\u0026s=8665f3c89de110a01675ff3763e5965d","navbar":{"links":[{"href":"mailto:implementations@getkroo.com","label":"Support"}]},"footer":{"socials":{"linkedin":"https://www.linkedin.com/company/kroo-construction"}},"contextual":{"options":["copy","view","chatgpt","claude","perplexity","mcp","cursor","vscode"],"display":"header"},"styling":{"latex":false},"navigation":{"global":{"anchors":[{"anchor":"Support","icon":"envelope","href":"mailto:implementations@getkroo.com"}]},"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"kroo","hasAudioNarration":false,"actualSubdomain":"kroo","customDomains":["guide.getkroo.com"],"gitSource":{"type":"github","owner":"getkroo","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6adbc5f23501f66ae6b01257","collectionId":"4a7529fd-b11b-44b4-b0f4-9fd9d6c6ff00","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6adbc5f23501f66ae6b01257"},"feedback":{"edits":true,"issues":true,"thumbs":true},"entitlements":{},"buildId":"6adbc5f23501f66ae6b01257","clientVersion":"0.0.4006","searchFilterCounts":[{"language":"default","tag":"Guides","count":13},{"language":"default","tag":"Platform","count":9},{"language":"default","tag":"Admin \u0026 Support","count":7},{"language":"default","tag":"API Reference","count":6},{"language":"default","tag":"Using the App","count":5},{"language":"default","tag":"Setup","count":5},{"language":"default","tag":"Permissions","count":4},{"language":"default","tag":"Schedule Files","count":4},{"language":"default","tag":"Two-Way Sync","count":3},{"language":"default","tag":"Data Lifecycle","count":3}]},"assistantConfig":{},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-v7-file-tree","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"pause-universal-search-reconcile","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"per-site-search-delta","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-private-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-nav-generations","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-agent-model-picker","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"custom.css","content":".navbar-logo img{width:auto;height:auto;max-height:64px}"}],"page":{"pagePath":"sso-setup","slug":"/sso-setup","pageMetadata":{"title":"SSO Setup","description":"Configure single sign-on for Kroo with Microsoft Entra ID, Okta, or Duo Security","icon":"shield-keyhole","href":"/sso-setup"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Configure single sign-on for Kroo with Microsoft Entra ID, Okta, or Duo Security\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={a:`a`,code:`code`,li:`li`,p:`p`,pre:`pre`,span:`span`,strong:`strong`,ul:`ul`,..._provideComponents(),...props.components},{CodeBlock,Heading,Info,Step,Steps,Tab,Tabs,Tip,Warning}=_components;if(!CodeBlock)_missingMdxReference(`CodeBlock`,true);if(!Heading)_missingMdxReference(`Heading`,true);if(!Info)_missingMdxReference(`Info`,true);if(!Step)_missingMdxReference(`Step`,true);if(!Steps)_missingMdxReference(`Steps`,true);if(!Tab)_missingMdxReference(`Tab`,true);if(!Tabs)_missingMdxReference(`Tabs`,true);if(!Tip)_missingMdxReference(`Tip`,true);if(!Warning)_missingMdxReference(`Warning`,true);return _jsxs(_Fragment,{children:[_jsx(_components.p,{children:`Single sign-on (SSO) lets your organization manage Kroo user authentication through Microsoft Entra ID, Okta, or Duo Security.`}),`\n`,_jsx(Heading,{level:`2`,id:`prerequisites`,children:`Prerequisites`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Kroo administrator access`}),` to your company’s SSO settings in the Kroo app`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Identity provider administrator access`}),` for Microsoft Entra ID, Okta, or Duo Security`]}),`\n`,_jsx(_components.li,{children:`Permission to create or update an OAuth/OIDC application in your identity provider`}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Required OIDC scopes for all SSO providers`}),`: Configure your identity provider’s application to allow `,_jsx(_components.code,{children:`openid`}),`, `,_jsx(_components.code,{children:`email`}),`, and `,_jsx(_components.code,{children:`profile`})]}),`\n`]}),`\n`,_jsx(Heading,{level:`2`,id:`setup`,children:`Setup`}),`\n`,_jsxs(_components.p,{children:[`As a Kroo administrator, open `,_jsx(_components.a,{href:`https://app.getkroo.com/settings?tab=company`,children:_jsx(_components.strong,{children:`Settings > Company`})}),` to configure SSO. Choose your identity provider and enter the required values using the steps below.`]}),`\n`,_jsx(Info,{children:_jsxs(_components.p,{children:[`Don’t see SSO settings after logging in? Confirm your account has the `,_jsx(_components.strong,{children:`Admin`}),` role. Contact `,_jsx(_components.a,{href:`mailto:implementations@getkroo.com`,children:`implementations@getkroo.com`}),` if you need help with access or run into any issues during setup.`]})}),`\n`,_jsxs(Tabs,{children:[_jsxs(Tab,{title:`Microsoft Entra ID`,id:`microsoft-entra-id`,children:[_jsx(_components.p,{children:`Use these steps to configure Microsoft Entra ID as your SSO provider.`}),_jsxs(Steps,{children:[_jsxs(Step,{title:`Configure API permissions in Microsoft Entra`,children:[_jsxs(_components.p,{children:[`Configure your Microsoft Entra app registration to allow the required OIDC scopes: `,_jsx(_components.code,{children:`openid`}),`, `,_jsx(_components.code,{children:`email`}),`, and `,_jsx(_components.code,{children:`profile`}),`.`]}),_jsx(_components.p,{children:`In your Microsoft Entra app registration, grant the required Microsoft Graph API permissions:`}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`User.Read`}),`: Allows Kroo to read the signed-in user’s basic profile`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Directory.Read.All`}),`: Allows Kroo to read directory data required for authentication`]}),`\n`]}),_jsx(Info,{children:_jsx(_components.p,{children:`Your Microsoft Entra administrator may need to grant admin consent after adding these permissions.`})})]}),_jsxs(Step,{title:`Add the redirect URI`,children:[_jsxs(_components.p,{children:[`In the app registration, go to `,_jsx(_components.strong,{children:`Authentication`}),`, add or edit the `,_jsx(_components.strong,{children:`Web`}),` platform, and add this redirect URI:`]}),_jsx(CodeBlock,{filename:``,numberOfLines:`2`,language:`text`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`text`,children:_jsxs(_components.code,{language:`text`,numberOfLines:`2`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`https://auth.getkroo.com/api/auth/sso/callback`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})})]})})}),_jsx(_components.p,{children:`Microsoft sends users back to this URL after a successful login.`})]}),_jsxs(Step,{title:`Create a client secret`,children:[_jsxs(_components.p,{children:[`In the app registration, go to `,_jsx(_components.strong,{children:`Certificates \u0026 secrets`}),` and create a new client secret.`]}),_jsx(Warning,{children:_jsx(_components.p,{children:`Copy the client secret value immediately. Microsoft Entra will not show it again after you leave the page.`})})]}),_jsxs(Step,{title:`Enter Microsoft Entra details in Kroo`,children:[_jsx(_components.p,{children:`In the Kroo app, open your company’s SSO settings and enter:`}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Verified Domain`}),`: The verified email domain users will use to sign in to Kroo, such as `,_jsx(_components.code,{children:`yourcompany.com`})]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Provider`}),`: Select `,_jsx(_components.strong,{children:`Microsoft Entra ID OIDC`})]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Issuer`}),`: `,_jsx(_components.code,{children:`https://login.microsoftonline.com/\u003ctenant-id>/v2.0`}),`, using your Microsoft Entra `,_jsx(_components.strong,{children:`Tenant ID`}),` from the app registration overview page. Use the tenant ID GUID, not the qualified tenant name such as `,_jsx(_components.code,{children:`yourcompany.onmicrosoft.com`})]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Client ID`}),`: Found on the app registration overview page`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Client Secret`}),`: The secret value generated under `,_jsx(_components.strong,{children:`Certificates \u0026 secrets`})]}),`\n`]})]})]})]}),_jsxs(Tab,{title:`Okta`,id:`okta`,children:[_jsx(_components.p,{children:`Use these steps to configure Okta as your SSO provider.`}),_jsx(Warning,{children:_jsxs(_components.p,{children:[`If your organization does not use the default `,_jsx(_components.code,{children:`https://*.okta.com`}),` Okta domain format, contact `,_jsx(_components.a,{href:`mailto:implementations@getkroo.com`,children:`implementations@getkroo.com`}),` before setup.`]})}),_jsxs(Steps,{children:[_jsxs(Step,{title:`Create an Okta app integration`,children:[_jsx(_components.p,{children:`In Okta, create a new OIDC app integration for Kroo.`}),_jsxs(_components.p,{children:[`Use `,_jsx(_components.strong,{children:`Web Application`}),` as the application type.`]}),_jsxs(_components.p,{children:[`Configure the app integration to allow the required OIDC scopes: `,_jsx(_components.code,{children:`openid`}),`, `,_jsx(_components.code,{children:`email`}),`, and `,_jsx(_components.code,{children:`profile`}),`.`]})]}),_jsxs(Step,{title:`Add the sign-in redirect URI`,children:[_jsx(_components.p,{children:`In the Okta app integration, add this sign-in redirect URI:`}),_jsx(CodeBlock,{filename:``,numberOfLines:`2`,language:`text`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`text`,children:_jsxs(_components.code,{language:`text`,numberOfLines:`2`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`https://auth.getkroo.com/api/auth/sso/callback`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})})]})})}),_jsx(_components.p,{children:`Okta sends users back to this URL after a successful login.`})]}),_jsx(Step,{title:`Assign users or groups`,children:_jsx(_components.p,{children:`Assign the Kroo Okta app integration to the users or groups that should be able to sign in to Kroo.`})}),_jsxs(Step,{title:`Enter Okta details in Kroo`,children:[_jsx(_components.p,{children:`In the Kroo app, open your company’s SSO settings and enter:`}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Verified Domain`}),`: The verified email domain users will use to sign in to Kroo, such as `,_jsx(_components.code,{children:`yourcompany.com`})]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Provider`}),`: Select `,_jsx(_components.strong,{children:`Okta`})]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Issuer`}),`: Your Okta issuer URL, such as `,_jsx(_components.code,{children:`https://yourcompany.okta.com`})]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Client ID`}),`: Found in the Okta app integration`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Client Secret`}),`: Generated for the Okta app integration`]}),`\n`]})]})]})]}),_jsxs(Tab,{title:`Duo Security`,id:`duo-security`,children:[_jsx(_components.p,{children:`Use these steps to configure Duo Single Sign-On as your OIDC provider.`}),_jsxs(Steps,{children:[_jsxs(Step,{title:`Create a Duo OIDC application`,children:[_jsxs(_components.p,{children:[`Configure a working authentication source for Duo Single Sign-On, then add a `,_jsx(_components.strong,{children:`Generic OIDC Relying Party`}),` application for Kroo in the Duo Admin Panel.`]}),_jsxs(_components.p,{children:[`See `,_jsx(_components.a,{href:`https://duo.com/docs/sso-oidc-generic`,children:`Duo’s setup instructions`}),` for authentication source and application configuration details.`]})]}),_jsxs(Step,{title:`Add the sign-in redirect URL`,children:[_jsxs(_components.p,{children:[`On the application’s `,_jsx(_components.strong,{children:`General`}),` tab, configure the `,_jsx(_components.strong,{children:`Authorization Code`}),` grant and add this `,_jsx(_components.strong,{children:`Sign-In Redirect URL`}),`:`]}),_jsx(CodeBlock,{filename:``,numberOfLines:`2`,language:`text`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`text`,children:_jsxs(_components.code,{language:`text`,numberOfLines:`2`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`https://auth.getkroo.com/api/auth/sso/callback`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})})]})})}),_jsx(_components.p,{children:`Duo sends users back to this URL after a successful login.`})]}),_jsxs(Step,{title:`Configure scopes and user access`,children:[_jsxs(_components.p,{children:[`On the `,_jsx(_components.strong,{children:`Scopes`}),` tab, allow all three required OIDC scopes: `,_jsx(_components.code,{children:`openid`}),`, `,_jsx(_components.code,{children:`email`}),`, and `,_jsx(_components.code,{children:`profile`}),`. These scopes are required for all Kroo SSO providers. Confirm the claims map to your users’ names and email addresses.`]}),_jsxs(_components.p,{children:[`Set `,_jsx(_components.strong,{children:`User access`}),` to allow the users or groups that should be able to sign in to Kroo, then save the application.`]})]}),_jsxs(Step,{title:`Enter Duo details in Kroo`,children:[_jsx(_components.p,{children:`In the Kroo app, open your company’s SSO settings and enter:`}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Verified domains`}),`: The email domains users will use to sign in to Kroo, such as `,_jsx(_components.code,{children:`yourcompany.com`}),`. These are separate from your Duo SSO domain`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Provider`}),`: Select `,_jsx(_components.strong,{children:`Duo Security OIDC`})]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Duo SSO domain`}),`: Your Duo hostname, such as `,_jsx(_components.code,{children:`sso-12345678.sso.duosecurity.com`}),`, with or without `,_jsx(_components.code,{children:`https://`})]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Client ID`}),`: Copy the full value from the Duo application’s `,_jsx(_components.strong,{children:`Metadata`}),` tab`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Client secret`}),`: Copy the value from the Duo application’s `,_jsx(_components.strong,{children:`Metadata`}),` tab`]}),`\n`]}),_jsxs(_components.p,{children:[`Kroo builds the issuer as `,_jsx(_components.code,{children:`https://\u003cduo-sso-domain>/oidc/\u003cclient-id>`}),` and discovers the OIDC endpoints automatically. Click `,_jsx(_components.strong,{children:`Save SSO`}),`.`]}),_jsx(Info,{children:_jsxs(_components.p,{children:[`You can also paste the full `,_jsx(_components.strong,{children:`Issuer`}),` URL from Duo’s `,_jsx(_components.strong,{children:`Metadata`}),` tab into `,_jsx(_components.strong,{children:`Duo SSO domain`}),`. Kroo preserves its path instead of appending the Client ID. Use this option if your issuer’s path identifier differs from your Client ID, such as with a multi-client Duo OAuth 2.1 / OIDC setup. Do not include `,_jsx(_components.code,{children:`/.well-known/openid-configuration`}),`.`]})})]}),_jsxs(Step,{title:`Update an existing Duo configuration`,children:[_jsx(_components.p,{children:`Leave the client secret blank to keep the existing secret. You can keep the saved full issuer URL and masked Client ID unchanged.`}),_jsx(_components.p,{children:`If you replace the full issuer URL with a domain-only value, re-enter the full Client ID. Kroo cannot build an issuer from the masked value.`})]})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`testing`,children:`Testing`}),`\n`,_jsx(_components.p,{children:`After saving your SSO settings, test sign-in with a user assigned to the identity provider application. Confirm the user can complete the provider login flow and return to Kroo successfully.`}),`\n`,_jsx(Tip,{children:_jsx(_components.p,{children:`Keep an existing Kroo administrator session open while testing SSO so you can update settings if the first attempt fails.`})}),`\n`,_jsx(Heading,{level:`2`,id:`support`,children:`Support`}),`\n`,_jsxs(_components.p,{children:[`If you run into issues during setup, contact `,_jsx(_components.a,{href:`mailto:implementations@getkroo.com`,children:`implementations@getkroo.com`}),`.`]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"SSO Setup","description":"Configure single sign-on for Kroo with Microsoft Entra ID, Okta, or Duo Security","icon":"shield-keyhole","href":"/sso-setup"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"Prerequisites","slug":"prerequisites","depth":2,"children":[]},{"title":"Setup","slug":"setup","depth":2,"children":[]},{"title":"Testing","slug":"testing","depth":2,"children":[]},{"title":"Support","slug":"support","depth":2,"children":[]}],"codeExamples":{}},"jsLinks":[],"subdomain":"kroo","siteName":"Kroo","title":"SSO Setup - Kroo","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-09-16T18:39:19.028Z","originalFileLocation":"sso-setup.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Configure single sign-on for Kroo with Microsoft Entra ID, Okta, or Duo Security\">\u003cmeta data-mint-head name=\"application-name\" content=\"Kroo\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"SSO Setup - Kroo\">\u003cmeta data-mint-head property=\"og:description\" content=\"Configure single sign-on for Kroo with Microsoft Entra ID, Okta, or Duo Security\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Kroo\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://guide.getkroo.com/sso-setup\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://kroo.mintlify.app/_mintlify/api/og/v2?division=Setup\u0026amp;title=SSO+Setup\u0026amp;description=Configure+single+sign-on+for+Kroo+with+Microsoft+Entra+ID%2C+Okta%2C+or+Duo+Security\u0026amp;theme=5d018ee466719ff565192a11\u0026amp;signature=3aa47855fe917d6bd17c76c548664c92a84f71fa3ed4e78fc7ac2fc3702b522d\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"SSO Setup - Kroo\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Configure single sign-on for Kroo with Microsoft Entra ID, Okta, or Duo Security\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://kroo.mintlify.app/_mintlify/api/og/v2?division=Setup\u0026amp;title=SSO+Setup\u0026amp;description=Configure+single+sign-on+for+Kroo+with+Microsoft+Entra+ID%2C+Okta%2C+or+Duo+Security\u0026amp;theme=5d018ee466719ff565192a11\u0026amp;signature=3aa47855fe917d6bd17c76c548664c92a84f71fa3ed4e78fc7ac2fc3702b522d\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/kroo/HftUu_hPSPzYZPZZ/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Kroo\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#0c7c59\">\u003clink data-mint-head rel=\"canonical\" href=\"https://guide.getkroo.com/sso-setup\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/sso-setup.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://guide.getkroo.com/#organization\",\"name\":\"Kroo\",\"url\":\"https://guide.getkroo.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://dkq5g4kc673o0.cloudfront.net/Kroo%20Logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https://guide.getkroo.com#website\",\"name\":\"Kroo\",\"url\":\"https://guide.getkroo.com\",\"publisher\":{\"@id\":\"https://guide.getkroo.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://guide.getkroo.com/sso-setup#webpage\",\"url\":\"https://guide.getkroo.com/sso-setup\",\"name\":\"SSO Setup\",\"description\":\"Configure single sign-on for Kroo with Microsoft Entra ID, Okta, or Duo Security\",\"dateModified\":\"2026-09-16T18:39:19.028Z\",\"isPartOf\":{\"@id\":\"https://guide.getkroo.com#website\"},\"breadcrumb\":{\"@id\":\"https://guide.getkroo.com/sso-setup#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://guide.getkroo.com/sso-setup#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Kroo\",\"item\":\"https://guide.getkroo.com\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSO Setup\",\"item\":\"https://guide.getkroo.com/sso-setup\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://guide.getkroo.com/sso-setup#article\",\"headline\":\"SSO Setup\",\"name\":\"SSO Setup\",\"description\":\"Configure single sign-on for Kroo with Microsoft Entra ID, Okta, or Duo Security\",\"url\":\"https://guide.getkroo.com/sso-setup\",\"mainEntityOfPage\":{\"@id\":\"https://guide.getkroo.com/sso-setup#webpage\"},\"dateModified\":\"2026-09-16T18:39:19.028Z\",\"publisher\":{\"@id\":\"https://guide.getkroo.com/#organization\"},\"isPartOf\":{\"@id\":\"https://guide.getkroo.com#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Kroo\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Kroo","nav":{"global":{"anchors":[{"anchor":"Support","icon":"envelope","href":"mailto:implementations@getkroo.com"}]},"tabs":[{"tab":"Platform","pages":[{"title":"Platform","href":""}]},{"tab":"Guides","pages":[{"title":"Guides","href":"/pipeline-analytics"}]},{"tab":"Admin \u0026 Support","groups":[{"group":"Setup","pages":[{"title":"SSO Setup","icon":"shield-keyhole","href":"/sso-setup"},{"title":"Kris Teams Bot","description":"Install and configure the Kris enterprise search bot for Microsoft Teams","icon":"message-bot","href":"/kris-teams-bot"},{"title":"Document Sources","icon":"folder-open","href":"/document-sources"},{"title":"Kroo MCP Setup","icon":"plug","href":"/kroo-mcp-setup"},{"title":"Windows Desktop App","icon":"desktop","href":"/windows-desktop-app"}]},{"group":"Maintenance","pages":[{"title":"Manual Data Refresh","icon":"rotate","href":"/manual-refresh"},{"title":"Sage On-Prem Agent Troubleshooting","icon":"screwdriver-wrench","href":"/sage-on-prem-troubleshooting"}]}]},{"tab":"API Reference","pages":[{"title":"API Reference","href":"/api-reference/authentication/issue-an-access-token"}]}]},"title":"SSO Setup - Kroo","buildId":"dpl_2xiSHD9XEvLsPGPcfoMtkLTB3dy9","deploymentId":"dpl_2xiSHD9XEvLsPGPcfoMtkLTB3dy9","dynamics":[],"chunks":[]}
