Setting up Federation in Access Identity can be completed by you in six steps. This guide provides you with an overview, as well as direct links, to what activities you need to complete to quickly and effectively set up Federation.

Before you can use Federation in Access Identity you must have completed the following prerequisites:

The following shows the steps needed to configure Federation in Access Identity:

To use Federation with Access Identity, the OpenID Connect Identity Provider (e.g. AD FS 2016 (or above), Microsoft Entra ID etc.) you wish to use must be configured to add Access Identity as an Application.

You can find support to configure AD FS 2016 (or above) and Microsoft Entra ID. For other providers, they provide similar capabilities but we can't provide specific instructions.

Security Policies allow you to set Session, Authentication, Two-Factor Authentication and Federation policies that are then applied to your users.

Create and configure a Security Policy >

The first step towards testing Federation settings is to sign in to Access Identity

by visiting https://identity.accessacloud.com/.

1. Select Security Policies.

2. Select the Security Policy you created above.

3. Scroll down to the Federation section.

4. Change the Identity Provider to OpenID Connect.

5. Enter a name for the Identity Provider – this will be shown to your users

when signing out.

6. Change the Grant type to Authorisation code.

7. Enter the Authority URL.

8. Enter the Client ID.

9. Enter the Client secret.

10. Check Use PKCE.

11. Select Test these settings.

If your OpenID Connect Identity Provider has been configured correctly, you will

be redirected to its sign-in screen.

1. Sign in using a valid account - this will be used for testing purposes only.

2. If the test fails, review your OpenID Connect Identity Provider

configuration and try again.

If the Federation settings test passes, you can now save the Security

Policy by selecting Save changes.

Federation has now been configured in Access Identity. Before it can be applied

to your users, ownership of your email domain must be verified

Before Federation settings can be configured in Access Identity you must first verify you're the owner of your organisation’s email domain. This is the part of your user’s email address after the @.

You can find support for verifying your domain ownership using this guide: Domain Verification.

To enable the Federation settings within the Security Policy and apply these settings to your users, you need to assign the security policy to your verified Domain and ensure that the Enable federation option is enabled.

You should now have successfully set up Federation in Access Identity. If you require support at this time, please raise a new case online or reach out to your Customer Success Manager.