This guide walks you through the basic steps required to enable SSO for Falcon using OpenID Connect (OIDC).
1. Understand the SSO model in Falcon (before you start)
Falcon uses OpenID Connect (OIDC) for SSO.
Falcon = Relying Party (Client)
Your Identity Provider (IdP) = Authentication authority
Falcon does not authenticate users itself when SSO is enabled
Users are identified by their email address
Access control (who may log in) is handled in the IdP, not in Falcon
2. Prerequisites
Make sure the following are in place:
SSO is enabled for your Falcon Hub
You have at least technical admin permissions in:
Falcon (Security / Authentication settings)
Your Identity Provider
An OIDC-capable IdP (e.g. Microsoft Entra ID, Okta, Auth0)
A clear decision on your SSO enforcement mode (see step 6)
3. Register Falcon as an application in your Identity Provider
In your Identity Provider:
Create a new application / client
Select OpenID Connect (OIDC) as the protocol
Configure:
Client ID
Client Secret
Note the following values (you will need them in Falcon):
Client ID
Client Secret
Tenant / Issuer identifier (if applicable)
⚠️ Do not configure redirect URLs yet — Falcon provides them later.
4. Create an Identity Provider in Falcon
In Falcon:
Go to Security & Privacy
Open Authentication
Select Manage identity providers
Create a new Identity Provider
Enter:
Issuer (OIDC issuer URL from your IdP)
Client ID
Client Secret
Save the configuration
After saving, Falcon generates a Callback URL (Redirect URI).
➡️ Copy this URL
5. Finalize the configuration in your Identity Provider
Back in your Identity Provider:
Open the Falcon application
Add the Callback URL from Falcon as a Redirect URI
Save the configuration
(Optional but recommended)
Restrict access via users or groups
Enable MFA according to your security policies
6. Choose the SSO enforcement mode in Falcon
In Falcon, configure how strictly SSO is enforced:
Recommended: Individual
Users must log in via SSO
Admins control provider assignment
Prevents user lockout
Best balance of security and flexibility
Other options:
Optional – SSO and classic login coexist (good for testing)
Mandatory – SSO only, no fallback (use with caution)
7. Test the SSO flow
Use “Sign in with this identity provider” in Falcon
You are redirected to your IdP
Authenticate successfully
Confirm the Falcon login via email (first-time linking)
Complete the setup
If enabled, Just-In-Time (JIT) provisioning automatically creates the Falcon user on first login.
8. User management essentials
Falcon users are matched by email address
Existing users can be linked to SSO automatically
User access is controlled in the IdP
Falcon controls how users log in, not who is allowed