> For the complete documentation index, see [llms.txt](https://docs.nected.ai/nected-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nected.ai/nected-docs/self-hosting/additional-configuration/single-sign-on-sso.md).

# Single Sign-On (SSO)

Single Sign-On (SSO) centralizes authentication for Nected so users can access the platform using their existing identity provider accounts. Instead of managing separate passwords or onboarding flows, SSO allows your teams to authenticate through systems already enforced inside your organization—improving security, reducing friction, and simplifying user lifecycle management.

Nected supports enterprise-grade SSO through standard identity providers. Each integration follows a consistent pattern: you configure an identity application inside your provider (Azure, Google, etc.), connect it with Nected, and update your deployment values so the platform can validate tokens securely.

## **Supported Identity Providers**

Nected supports major enterprise identity systems. Each provider has its own configuration guide:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-cover data-type="image">Cover image</th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Microsoft Entra ID (Azure AD)</strong></td><td>Full setup instructions include app registration, redirect URIs, credential generation, and Helm configuration.</td><td><a href="/files/WAwI5i7bGjXSmkxEYLta">/files/WAwI5i7bGjXSmkxEYLta</a></td><td><a href="/pages/7CTBw24i5pEbm1FhQMN0">/pages/7CTBw24i5pEbm1FhQMN0</a></td></tr><tr><td><strong>Google Workspace</strong></td><td>Will include steps for OAuth Client setup, scopes, redirect URIs, and Nected environment configuration.</td><td><a href="/files/RbHbSJmUZEdca00FrdhU">/files/RbHbSJmUZEdca00FrdhU</a></td><td><a href="/pages/n2l0WjzS7TKMoWTviSsj">/pages/n2l0WjzS7TKMoWTviSsj</a></td></tr></tbody></table>

## Disable Email/Password Login (SSO-Only Access)

If you've already set up SSO for your self-hosted Nected instance, you might've noticed something — users can still log in with their email and password even after SSO is configured. That's expected. SSO being enabled doesn't automatically turn off the password login form. You have to do that separately.

This is common for teams with a security or compliance requirement to force all authentication through their identity provider (Entra ID, Okta, whatever you're using). Here's how to actually lock it down.

### What this does

Once you disable password auth, users lose the ability to sign in with a username/password combo entirely. The login screen will only show the SSO option. There's no fallback — so make sure your SSO setup is fully working and tested before you flip this switch, or you could lock everyone out, including yourself.

### Steps

Password login is controlled through environment variable overrides in your `nected-values.yaml` file.

1. Open `nected-values.yaml`
2. Add `envVars` under both `konark` and `nalanda` (or update them if they're already there):

   ```
   konark:
     envVars:
       VITE_ENABLE_AUTH_FORM: false

   nalanda:
     envVars:
       PASSWORD_AUTH_ENABLED: "false"
   ```
3. Apply the changes with Helm:

```
helm upgrade -i nected nected/nected -f nected-values.yaml
```

That's it. No extra restart steps — Helm handles the rollout.

### A couple of things to note

* `VITE_ENABLE_AUTH_FORM` hides the password form on the frontend (konark). `PASSWORD_AUTH_ENABLED` disables it on the backend (nalanda). You need both — setting only one doesn't fully block password login.
* This is an all-or-nothing switch per environment. If you're running separate Dev/Stg/UAT/Prod environments, you'll need to apply this in each `nected-values.yaml` where you want password login disabled.
* Test this in a lower environment first if you can. Once applied, the only way back in is through SSO or by reverting the values and re-running the Helm upgrade.

{% hint style="info" %}
If you run into issues after applying this — say, users getting locked out or SSO not routing correctly — reach out to <support@nected.ai> and we'll help sort it out.
{% endhint %}

Additional providers will be added over time based on enterprise requirements.