Skip to content

Choose how members sign in

Decide whether your members sign in here with their own passkeys or passwords, through your identity provider, or either way, and which sign-in methods and passkey properties your tenant requires.

Who can do it

A tenant administrator or a tenant access administrator, or a platform super administrator working inside your tenant, holding the permission to manage the tenant's authentication policy. Every built-in tenant role can read the requirements; without the permission to manage them, the controls are shown disabled and Save is not offered.

On a SaaS deployment, a platform operator working inside your tenant under a support-access session cannot change them.

Before you start

  • Your tenant can only restrict what the deployment allows. A method the deployment does not admit is refused.
  • Through the identity provider only has two preconditions:
    • An active OIDC or SAML identity provider: your tenant's own, or the deployment's that your tenant inherits. An LDAP directory does not count.
    • A ready break-glass identity: an active member you designated for break-glass access on the users screen, holding the deployment's minimum number of security keys or device-bound passkeys, so that someone can enter when the provider cannot be reached.
  • Here only is refused while any member is restricted to the identity provider on the users screen. Return those members to the tenant's posture first.
  • The change applies to the next sign-in of every member. Sessions already open are not affected.
  • Saving asks for a recent sign-in.

Steps

  1. Open Settings and select the Access & policies tab. How members sign in is at the top.
  2. Under Where members sign in, choose one:
    • Here only: members sign in with the methods below; an identity provider lets nobody in.
    • Here or through the identity provider: the methods below, or the provider a member is linked to. This applies when nothing is chosen.
    • Through the identity provider only: a member linked to the provider signs in only through it; your break-glass members still sign in with the methods below.
  3. Under Sign-in methods, tick Passkey, Password and authenticator app, or both.
  4. Under Required passkey properties, tick any property every passkey must hold, such as Hardware-backed or Phishing-resistant. Only a passkey can hold a property.
  5. Check In effect for every sign-in: it shows the result once the deployment's own allowance is applied, and where the identity providers come from.
  6. If you chose Through the identity provider only, check that Break-glass access reports it is ready.
  7. Select Save.

What you see when it worked

The console confirms Sign-in requirements saved, and In effect for every sign-in shows the new posture. The change is recorded in the audit trail with the values before and after.

A member whose authenticators no longer meet the requirements is asked, at their next sign-in, to add one that does.

If it fails

The console shows a refusal beside the group it concerns, and nothing is saved.

What you see Cause What to do
FEDERATED_ONLY needs an active OIDC or SAML identity provider for the tenant, its own or the deployment's it inherits, and there is none, so no member could sign in. Nothing was changed. No active OIDC or SAML provider serves your tenant Declare and enable your provider, or choose another option
Cannot switch to federated-only: no designated break-glass member of this tenant holds the required number of security keys or device-bound passkeys. Nothing was changed. No break-glass member is ready Designate a member for break-glass access and have them register enough security keys
Cannot switch to local-only: <n> member(s) of this tenant sign in only through their identity provider and would be left with no way to sign in. Return each to the tenant's posture first. Nothing was changed. Some members are restricted to the identity provider On the users screen, return each of them to the tenant's posture
A refusal naming a sign-in method the deployment does not admit The deployment allowance forbids that method Untick it
A refusal on the required properties A property is required while passkeys are not admitted Tick Passkey, or clear the properties
A refusal saying another change was saved first Someone else changed the requirements Reload the screen and make your change again

Without the console

Surface How
API PUT /api/v3/admin/tenants/{tenantId}/authentication-posture (operation replaceTenantAuthenticationPosture), with allowedMechanisms (PASSKEY, PASSWORD_TOTP), requiredProperties and, optionally, mode (LOCAL_ONLY, MIXED or FEDERATED_ONLY). A request without mode keeps the stored one

No ankasecure-km command and no Admin SDK method manage the authentication posture.