Identity Providers
Connect your identity provider for either or both:
- Workplace sign-in: let people sign in with their company accounts. Single Sign-On maps directory claims to Archestra roles and teams.
- Tools acting as each person: exchange the caller's company token for a downstream API token. Follow the provider-specific setup for Microsoft Entra ID or Okta.
Identity providers are an Enterprise feature. Setup requires admin access in your provider and identityProvider:create in Archestra.

Explore
Single Sign-On
Add workplace sign-in and map directory claims to access
Microsoft Entra ID
Configure Microsoft Entra ID for SSO sign-in and On-Behalf-Of token exchange for MCP tools
Okta
Configure Okta for SSO sign-in and RFC 8693 token exchange for MCP tools
Account Security
Two-factor authentication, session lifetime caps, and CLI account recovery
