Connect your identity provider

01In a nutshell #sec_2f7ebae4

The directory authorized to authenticate users of this subscription declares itself, proves itself by a real connection, then is adopted — and at no time can anyone be locked out.

02Where #sec_4e25ef67

Security & access › Identity provider. The warning at the top indicates the gravity of the action: Changing this directory changes who can connect. The action is recorded in the audit trail.

Without a declared directory, the platform's default applies — this is the state of a new subscription. Your users are already connecting; this process is to make them cross your door.

03The three steps #sec_3be48e4c

The screen is designed so that a directory change can never lock the subscription. It therefore imposes three steps, and the order is non-negotiable.

Between the three, the current directory continues to serve.

041. Declare a directory #sec_ad2f8e08

The Declare a directory section requires four blocks.

The directory — where your users' identities live. REVIEWIT never stores their passwords. A name, a type, and the authority: the issuer's address, without the final path. REVIEWIT reads its discovery document to find the rest.

How REVIEWIT proves its identity — your directory must recognize REVIEWIT before responding to it. These are REVIEWIT's identifiers, not a user's. A client identifier, and a secret reference — a reference, never the value. The value is provisioned on the authority's host. You do not paste a secret into this screen, and that's intentional.

Create accounts on first connection — a person connecting for the first time gets a REVIEWIT account immediately. This gives them no rights. Rights come from roles and authorizations, never from the connection.

Assurance parameters — what constitutes strong authentication with THIS provider. The amr values that attest to the double factor (mfa, otp, fido), those resistant to phishing, and the acr authentication context (in Entra ID it's the Authentication Context identifier, enforceable by conditional access). An empty field reverts to the host's default. The screen warns: this is the setting most often corrected after a proof failure: your directory announces the double factor under another name.

A separate box: This directory requires two-step validation for all accounts. This is a declared trust, for directories that never attest to the second factor in their tokens (Google Workspace is one). The audit trail notes it as declared, not proven. Only check it if it's true for you.

The act — changing the directory is an act of authority: it is recorded in the trail, with its reason and author. The reason is mandatory, in your words: this is what makes the audit trail readable months later.

Declare this directory. It serves no one until a connection has proven that it works.

052. Prove #sec_fb872bae

In Declared directories, the candidate appears: Awaiting a proof connection. This directory is declared but still serves no one. Connect once through this door to adopt it.

Connect to adopt it: you will be directed to the candidate directory, you will authenticate there, then you will return here. No session is opened there: this connection only establishes that the door opens.

If the proof fails, the line reads Proof failed and the time. Common causes: the client identifier refused by the directory, the secret not provisioned on the host, or the double factor announced under another name — back to the assurance parameters, the block that is revisited to correct after a proof failure. Abandon removes a candidate; nothing has changed for users.

063. Adopt #sec_6970fab7

Proof recorded unlocks Adopt this directory. From then on, it is In service: it is the one that authenticates. The old one remains listed, and Deactivate removes it from service.

Keep one thing in mind before adopting: roles and authorizations are assigned to people from a directory that authenticates. If your administrators and managers were taken from the old directory, check that they exist in the new one — otherwise, after adoption, the authorization will appear active and will no longer open anything.

07What this screen does not do #sec_6a3443ce

It does not connect a data source. A directory that authenticates and a tenant that REVIEWIT collects are two statements, often for the same directory. The collection is the next page.

08To remember #sec_9ab09d60

Declare without the secret value, prove by a real connection, then adopt. The product refuses to lock you out, and everything is written to the track with your reason. The setting that gets stuck is almost always the insurance one.