---
title: "Establishing an SSO connection"
url: "https://helpdesk.kontainer.com/article/establish-an-sso-connection/"
type: "article"
category: ["Admin settings", "Integrations & plugins", "Users, groups & permissions"]
tags: ["Admin users only", "PIM", "Premium+ plans", "DAM"]
language: "en"
published: "2023-10-12T06:56:01+00:00"
updated: "2026-03-12T10:07:11+00:00"
summary: "You can set up users in Kontainer via SSO to create a secure and seamless experience for your internal users. We have a standard setup for Microsoft Entra ID, ADFS and Google. Get in touch for other s…"
---

# Establishing an SSO connection

You can set up users in Kontainer via SSO to create a secure and seamless experience for your internal users.

We have a standard setup for Microsoft Entra ID, ADFS and Google. [**Get in touch for other setups**](mailto:js@kontainer.com?subject=SSO%20Enquiry).

We create a ‘’Trust’’ between your Active Directory groups (managed by your IT) and Kontainer. This means the user will automatically be created and assigned to predetermined groups when they log in the first time.

Like any other group in Kontainer, you can always change and manage access settings.

You can also assign extra rights to individual users that are added to the basic permissions, they inherit from their group membership.

To keep your user list manageable, you can determine rules that will deactivate or delete users that have not been logged in for a certain amount of time – like 2, 4 or 6 months. If a user logs in again after being auto-deleted, their user is simply reactivated.

Alongside SSO users, you can add other users and groups manually.

Go to the [**Kontainer integration page**](https://kontainer.com/integrations/sso) to find out more about the use cases, benefits, etc.\
 The SSO includes, among others, [Azure/Entra ID](https://kontainer.com/integrations/entraid), [Okta SSO](https://kontainer.com/integrations/okta), and [Google SSO](https://kontainer.com/integrations/googlesso).

In the following, we will walk you through the setup of a Microsoft Entra ID SSO connection to Kontainer:

---

## Azure/Entra ID App Registration

### *Step 1:* **Create a resource**

On Entra ID services home click ”**Entra ID Active Directory**”

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-1.png)

### *Step 2:* **Register app**

In the right menu, click ”**App registrations**”

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-2.png)

#### **New Registration**

At the top, click “**New registration**”

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-3.png)

#### **Fill in the details**

- **Name:** Kontainer
- **Redirect URI:** [https://xxx.kontainer.com/login/entraid](https://xxx.kontainer.com/login/entraid) (replacing xxx with Kontainer client id)

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-4.png)

### *Step 3:* **Authenticate**

Click “**Authentication**” and fill in details:

- **Logout URL:** [https://xxx.kontainer.com/logout](https://xxx.kontainer.com/logout)

Check the boxes

- “**ID tokens**”
- “**Multitenant**”

Click “**Save**”

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-5.png)

### *Step 4:* **Certificate and secret**

Click “**Certificates and secrets**” and then “**New client secret**”.

Fill in:

- **Description:** Kontainer

Set "**Expires**" to “**Never**”

**NOTE:** Write down secret.

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-6.png)

### *Step 5:* **Token configuration**

Click “**Token configuration**”, and then “**Add optional claim**”.

Select “**ID**” and check

- “**email**”
- “**upn**”

Click “**Add**”.

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-7.png)

### *Step 6:* **Edit group claim**

Click "**Add groups claim**" and check:

- "**Security groups**"
- "**ID**"

And then check:

- "**Group ID**"

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-8.png)

### *Step 7:* **API permissions**

Go to "**API permissions**" and click "**Add a permission**".

Choose "**Microsoft Graph**" and click “**Delegated permissions**"

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-9.png)

#### **OpenID permissions**

Scroll down to OpenID permissions and check **“email”** and **“profile”**

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/09/Entra-ID-App-Registration1.jpeg)

#### **Application permissions**

Scroll down to "Application" and check **“Application.Read.All”**

![](https://helpdesk.kontainer.com/wp-content/uploads/2026/01/Screenshot-2026-01-15-at-07.52.16.png)

#### **GroupMember**

Scroll down to “**GroupMember**” and check:

- “**GroupMember.Read.All**”

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/04/Entra-ID_img-10.png)

### *Step 8:* **Check permissions**

Permissions should now be as below.

Perhaps you will need an administrator to consent the permissions.

![](https://helpdesk.kontainer.com/wp-content/uploads/2025/09/permissions-Entra-ID-App-Registration1.jpeg)

### *Step 9:* **Send details to Kontainer support**

Go to “**Overview**” where you can find the details below to send to your Kontainer contact or [support@kontainer.com](mailto:support@kontainer.com):

- “**Application (client) ID**”
- “**Directory (tenant) ID**”

**NOTE:** Send the saved secret in a safe way.

---

## Other languages

- [Deutsch](https://helpdesk.kontainer.com/de/article/sso-single-sign-on-anbindung-einrichten/index.md)

## Related articles

- [Strapi Integration Guide](https://helpdesk.kontainer.com/article/strapi-integration-guide/index.md): With Kontainer's Strapi integration, you can easily insert images, videos, and files directly from your DAM into Strapi's admin panel — without manually downloading and uploading.
- [Slack Notifications from Kontainer](https://helpdesk.kontainer.com/article/slack-notifications-from-kontainer/index.md): Bring Kontainer notifications directly into Slack and stay updated without monitoring multiple systems. The Slack integration lets you decide exactly which notifications you want to receive and whethe…
- [Multi-Brand Guide](https://helpdesk.kontainer.com/article/multi-brand-guide/index.md): The Multi-Brand feature allows you to create and manage multiple branded experiences within a single Kontainer account. Each brand can have its own logo, colors, fonts, styling, and login experience,…
- [WordPress Integration Guide](https://helpdesk.kontainer.com/article/wordpress-plugin-guide/index.md): With Kontainer’s WordPress integration, you can easily insert images, videos, and files directly from your DAM into WordPress—without manually downloading and uploading.