Single Sign-On
Strise supports Single Sign-On (SSO) via Auth0, enabling your team to log in with their existing corporate credentials.
There are two ways to get there, and which one you have changes what is possible.
Shared and dedicated connections
| Shared | Dedicated | |
|---|---|---|
| How users sign in | The Microsoft or Google button on the login page | Their email domain, or their provider's own sign-in page |
| Setup | None. Available to everyone | Arranged with Strise, completed by your identity provider team |
| Who can sign in | Anyone with an account in Strise and a Microsoft or Google identity | Whoever your identity provider assigns to the Strise application |
| Providers | Microsoft Entra ID, Google | Microsoft Entra ID, Okta Workforce, other SAML providers |
| Your provider's sign-in policy (MFA, device rules, conditional access) | Applies, as your provider applies it to any sign-in | Applies, and Strise access can be granted and withdrawn there |
| User provisioning (SCIM) | Not available | Available |
| Access governed by directory groups | No | Yes, see Identity federation |
The shared connections are the default and need nothing from you. The Microsoft button is an Auth0 Entra Enterprise Connection configured for multi-tenant access over OIDC, so any organisation using Microsoft Entra ID can authenticate through it without per-tenant configuration. It authenticates people; it does not decide who has access to Strise, and accounts are still created and removed inside Strise.
A dedicated connection is your organisation's own. Because it is yours, your identity provider becomes the place where Strise access is granted and withdrawn, and provisioning can keep groups, memberships and roles in sync. That is what Identity federation covers.
Login Experience
Strise uses email-based redirection to determine how each user should authenticate:
- Users whose email domain is configured for a dedicated connection are automatically redirected to their identity provider.
- The login page also displays Microsoft and Google buttons that use the OIDC (OpenID Connect) protocol for authentication.
SSO Login Flow
- The user enters their email address on the Strise login page.
- Strise checks whether the email domain has an SSO connection configured.
- If SSO is configured, the user is redirected to their identity provider (e.g., Microsoft Entra ID).
- After successful authentication, the user is redirected back to Strise with an active session.
API Authentication
For API access, Strise uses JWT (JSON Web Tokens). After authenticating via SSO, a JWT is issued that can be used for subsequent API requests.
Directory Synchronization
Directory synchronization over SCIM is available with a dedicated connection. Your identity provider pushes users and groups to Strise, each group is mapped to a role on a team or across the organisation, and membership there decides access here. Without it, user management is done in Strise by administrators, who invite, deactivate and manage roles directly.
See Identity federation for setup and day-to-day operation.
Setup
To configure a dedicated connection for your organisation, contact the Strise team at support@strise.ai. The team issues a guided setup that your IT administrators complete for Microsoft Entra ID, Okta Workforce or another SAML provider.
Last updated on