Single sign-on & federation

​

Sign in with your own identity provider

For federated users, sign-in uses your existing work account. When federation is configured, users opening Insight authenticate with your organisation’s own identity provider using the work account they already have. Insight trusts the result and does not receive the password used at your identity provider. Locally managed accounts are a separate sign-in path. Federation is built on OpenID Connect (OIDC), the industry-standard protocol for federated sign-in, and works with OIDC-compliant identity providers such as Microsoft Entra ID, Okta, and Auth0. Microsoft Entra ID is the most common choice and comes with a fully guided onboarding.

​

How it works

1. A user opens Nobly Insight and is redirected to your identity provider to sign in.
2. Your identity provider authenticates the user — applying your MFA and access policies — and confirms the user’s identity and role assignments to Insight.
3. Insight signs the user in and aligns their user group memberships with the roles your identity provider confirmed.

The whole exchange is invisible to the user: for most, signing in to Insight is a single click that reuses their existing work session.

​

Your groups drive access in Insight

Access in Insight is governed by user groups — they carry application permissions, document access rights, and everything else described in this section. Federation connects those groups to your directory:

• Each Insight user group is published as a role on the Nobly Insight application in your identity provider.
• You assign your own directory groups (or individual users) to those roles, using the admin tooling you already know.
• At each sign-in, the user’s Insight group memberships are updated to match their current role assignments — memberships are granted and revoked automatically.

The mapping between your directory groups and Insight roles lives in your identity provider, fully under your control. Moving a user between directory groups is all it takes to change what they can do in Insight.

​

Accounts are provisioned automatically

For federated people, routine provisioning and sign-in policy are managed through your identity provider:

• First sign-in creates the account. New employees get access by being added to the right directory group — no request to Nobly, no manual account creation.
• Federated passwords stay with your identity provider. Manage those passwords and sign-in policies there; local accounts and API client secrets have separate lifecycles.
• Leavers are managed centrally. Disable or remove a user in your directory to prevent new federated sign-ins. Coordinate existing sessions and urgent access removal with your identity administrator.

Insight still provides Users and user groups for account inspection, local and service accounts, and access troubleshooting. Make durable changes to federated role assignments in the identity provider; the next sign-in can overwrite manual membership changes in Insight.

​

Division of responsibility

​

Getting connected

Each Insight environment (for example test and production) is connected separately, so you can trial federation in test before enabling it for production users. During onboarding, Nobly sends your identity administrators a tailored setup guide for your environment. It walks through approving the Nobly Insight application, restricting it to assigned users, mapping your groups to Insight roles, applying your MFA and conditional-access policies, and validating the connection — typically well under an hour of an administrator’s time, with an optional script that automates the steps. To get started, or to connect an identity provider other than Microsoft Entra ID, contact support@nobly.dk.

​

Where to read next