---
title: "Configure sign-in"
description: "Choose an identity provider or local passwords, then configure account access and session rules."
canonical_url: "https://docs.oz0.ai/admin/sign-in"
---
# Configure sign-in

> Choose an identity provider or local passwords, then configure account access and session rules.

For: cluster and tenant administrators.

People sign in to the console in one of two ways:

- Through an identity provider over OpenID Connect: Okta, Microsoft Entra ID, Keycloak, Google, Authentik, or any other provider that speaks OIDC. The provider checks who they are, and its groups can decide their roles.
- With a password, kept by the cluster, and a second step: a code from an authenticator app, which a policy can require.

People sign in to the CLI the same way, with `oz0 login` and the provider's device flow ([in this guide](https://docs.oz0.ai/admin/sign-in/clients#the-cli-oz0-login)): the CLI then acts as them. Operators keep their certificate for the cluster's own work, apps use [API keys](https://docs.oz0.ai/build/apps/runtime-api/authentication#authentication), and an app can act as the person who uses it through a [token exchange](https://docs.oz0.ai/build/apps/runtime-api/authentication#apps-that-act-as-their-people). An MCP client, such as an IDE, acts as a person after they [approve it at the console](https://docs.oz0.ai/admin/sign-in/clients#mcp-clients).

Choose an identity provider or local passwords, then configure account access and session rules.

## Choose a task

<table>
<thead>
  <tr>
    <th>
      Task
    </th>
    
    <th>
      Guide
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Configure an identity provider
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/admin/sign-in/identity-providers">
        Open guide
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      Provision accounts from a directory
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/admin/sign-in/provisioning">
        Open guide
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      Manage passwords and second factors
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/admin/sign-in/passwords">
        Open guide
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      Sign in from the CLI and MCP clients
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/admin/sign-in/clients">
        Open guide
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      End sessions and inspect sign-in events
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/admin/sign-in/sessions">
        Open guide
      </a>
    </td>
  </tr>
</tbody>
</table>

## Previous section links

<span id="add-an-identity-provider">

Add an identity provider

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/identity-providers#add-an-identity-provider).

<span id="what-the-server-checks">

What the server checks

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/identity-providers#what-the-server-checks).

<span id="accounts">

Accounts

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/identity-providers#accounts).

<span id="roles-from-groups">

Roles from groups

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/identity-providers#roles-from-groups).

<span id="microsoft-entra-id">

Microsoft Entra ID

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/identity-providers#microsoft-entra-id).

<span id="from-a-file">

From a file

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/identity-providers#from-a-file).

<span id="accounts-from-a-directory">

Accounts from a directory

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/provisioning#accounts-from-a-directory).

<span id="a-provisioners-credentials">

A provisioner's credentials

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/provisioning#a-provisioners-credentials).

<span id="which-tenants-a-provisioner-gives-roles-in">

Which tenants a provisioner gives roles in

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/provisioning#which-tenants-a-provisioner-gives-roles-in).

<span id="a-second-step-with-passwords">

A second step with passwords

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/passwords#a-second-step-with-passwords).

<span id="require-it">

Require it

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/passwords#require-it).

<span id="lost-phone">

Lost phone

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/passwords#lost-phone).

<span id="the-cli-oz0-login">

The CLI: `oz0 login`

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/clients#the-cli-oz0-login).

<span id="mcp-clients">

MCP clients

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/clients#mcp-clients).

<span id="sessions">

Sessions

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/sessions#sessions).

<span id="passwords">

Passwords

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/passwords#passwords).

<span id="in-the-audit-log">

In the audit log

</span>

: [open guide](https://docs.oz0.ai/admin/sign-in/sessions#in-the-audit-log).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.