> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insight.nobly.dk/llms.txt
> Use this file to discover all available pages before exploring further.
# Single sign-on & federation
> Sign in to Nobly Insight with your organisation's own identity provider over OpenID Connect — Microsoft Entra ID, Okta, Auth0, and other OIDC-compliant providers.
## Sign in with your own identity provider
Nobly Insight does not ask your users to remember another password. Sign-in is **federated**: when a user opens Insight, they authenticate with your organisation's own identity provider using the work account they already have. Insight trusts the result — it never sees or stores your users' credentials.
Federation is built on **OpenID Connect (OIDC)**, the industry-standard protocol for federated sign-in, and works with OIDC-compliant identity providers such as **Microsoft Entra ID**, **Okta**, and **Auth0**. Microsoft Entra ID is the most common choice and comes with a fully guided onboarding.
Because authentication happens in *your* identity provider, your existing sign-in policies apply automatically — multi-factor authentication, conditional access, device compliance, and session rules are all enforced by you, on your terms.
## How it works
1. A user opens Nobly Insight and is redirected to your identity provider to sign in.
2. Your identity provider authenticates the user — applying your MFA and access policies — and confirms the user's identity and role assignments to Insight.
3. Insight signs the user in and aligns their [user group](/permissions/introduction#permissions-are-granted-to-user-groups) memberships with the roles your identity provider confirmed.
The whole exchange is invisible to the user: for most, signing in to Insight is a single click that reuses their existing work session.
## Your groups drive access in Insight
Access in Insight is governed by user groups — they carry [application permissions](/permissions/application-permissions), document access rights, and everything else described in this section. Federation connects those groups to your directory:
* Each Insight user group is published as a **role** on the Nobly Insight application in your identity provider.
* You assign your own directory groups (or individual users) to those roles, using the admin tooling you already know.
* At each sign-in, the user's Insight group memberships are updated to match their current role assignments — memberships are granted *and* revoked automatically.
The mapping between your directory groups and Insight roles lives in your identity provider, fully under your control. Moving a user between directory groups is all it takes to change what they can do in Insight.
Role assignment changes take effect the next time the user signs in to Insight.
## Accounts are provisioned automatically
There is no user administration to do in Insight itself:
* **First sign-in creates the account.** New employees get access by being added to the right directory group — no request to Nobly, no manual account creation.
* **No passwords in Insight.** Insight holds no credentials for federated users; there is nothing to reset, rotate, or leak.
* **Leavers lose access centrally.** Disable or remove a user in your directory and they can no longer sign in to Insight.
## Division of responsibility
| You control | Nobly manages |
| ---------------------------------------------------------------------- | ------------------------------------------------------------------- |
| Who can sign in — user and group assignments in your identity provider | The Insight application registration and its role catalogue |
| Sign-in policy — MFA, conditional access, session rules | The identity service that Insight environments authenticate against |
| The mapping of your directory groups to Insight roles | Keeping Insight group memberships in sync at every sign-in |
## Getting connected
Each Insight environment (for example test and production) is connected separately, so you can trial federation in test before enabling it for production users.
During onboarding, Nobly sends your identity administrators a **tailored setup guide** for your environment. It walks through approving the Nobly Insight application, restricting it to assigned users, mapping your groups to Insight roles, applying your MFA and conditional-access policies, and validating the connection — typically well under an hour of an administrator's time, with an optional script that automates the steps.
To get started, or to connect an identity provider other than Microsoft Entra ID, contact [support@nobly.dk](mailto:support@nobly.dk).
## Where to read next
How data sources, dashboards, and elements fit together for the people who build and view reports.
How access is controlled in Nobly Insight, and how user groups carry permissions.
Grant and revoke permissions for the user groups your federation roles map to.