SAML 2.0
The assertion most business SaaS speaks. InstaSafe runs it in both directions — as your identity provider, or as a service provider federating to the one you already have.
IdP and SP initiatedSingle sign-on
Log in once. Get everything you're allowed.
One set of credentials, one dashboard, every provisioned application — with MFA and device checks built into that single login.
One identityOne username and password for everything you're allowed to access.
Built-in securityMFA, device trust and risk checks protect every login by default.
Zero frictionUsers get to their work faster. IT stays in control.
Nothing extraNo shared passwords. No excess access. No exceptions.
What is SSO?
Single sign-on
One login session, honoured by many applications.
Instead of a password per app — remembered, reused, written down, phished — the user authenticates once to an identity provider, which then vouches for them to each application using a cryptographic assertion, most commonly SAML.
- SecurityOne strongly-defended login, with MFA on it, replaces dozens of weak ones. Password reuse stops mattering because there is only one password left to reuse.
- OperationsOnboarding is “add to group”. Offboarding is “disable user” — not a checklist of fifteen admin consoles, each of which someone has to remember exists.
- ExperiencePeople stop burning minutes and helpdesk tickets on forgotten passwords. The security improvement and the convenience improvement are the same change.
- VisibilityWhen every login flows through one point, “who accessed what, when, from where” becomes a report instead of an investigation.
1login to defend
1action to offboard
3protocols — SAML, OAuth, OIDC
The password problem
Password sprawl, felt.
Sign in to a few apps the old way — watch the mood drop.
Password fatigue0%
0 logins0 resets
Sign in to a few apps — watch the mood drop.
01
One reused password = many breached apps
Users reuse; attackers know. One leaked password becomes access attempts everywhere.
02
Offboarding by checklist
Every leaver means manual revocation across every app. One missed console is a live account owned by someone who no longer works for you.
03
Invisible access
Without a central login point, nobody can answer “which apps did this user reach last quarter?” — an audit question that will be asked.
How it flows
From your directory to every app — in one token.
1 login → your whole app estate
Your directory_InstaSafe decides_Your apps_
Active Directory
Google Workspace
Okta / your IdP
SaaS apps
Internal apps
Legacy apps
Authenticate
Issue SSO token
Apply policy
SAML assertion
NameID: you@company.com
AuthnContext: MFA
Session token
device: trusted · mfa: passed
ttl: 8h
Access decision
grant: your app estate
revoke: one click
Your directory_
- Active Directory
- Google Workspace
- Okta / your IdP
InstaSafe decides_
- AuthenticateNameID: you@company.com
- Issue SSO tokendevice: trusted · mfa: passed
- Apply policygrant: your app estate
Your apps_
- SaaS apps
- Internal apps
- Legacy apps
See it, don't just read it
One login beats six, every time.
Six app logins, timed side by side — with a password-reset detour thrown in for realism.
Without SSO01:47
vsWith InstaSafe0:09
What you get
What SSO includes.
One login is the surface. Underneath it are the protocols your estate already speaks, the checks that login carries, and the record it leaves behind.
8 protocols · one login
OAuth 2.0
Authorises an application to act with a scoped token instead of handing it a password. The scope is the point: an integration gets what it needs and nothing adjacent.
Scoped tokensOpenID Connect
OAuth with an identity claim on top, which is what modern applications actually ask for. Same single login, expressed in the format the newer half of your estate expects.
ID tokens on OAuthRADIUS
The protocol your switches, wireless controllers and older VPN concentrators already talk. It means the network gear can ask the same identity a browser does.
Network device authTACACS+
Separates authentication from authorisation and accounting, which is why network teams keep it for administrative logins to routers and firewalls.
Per-command controlKerberos
The Windows domain login your people already completed this morning. Desktop SSO means that ticket carries into the portal — no second prompt at the start of the day.
Domain ticket reuseFIDO2 / WebAuthn
Hardware keys and platform biometrics, bound to the origin. A credential that cannot be replayed on a lookalike domain, because the browser refuses to offer it there.
Hardware-backed factorLDAP
Reads the groups you already maintain in Active Directory or an LDAP server, so entitlement stays where your joiners-movers-leavers process already lives.
Group source of truthThe single login carries the strong factors.
Hover any card to watch it happen. Nothing here needs a second portal, a second password, or a ticket queue.
MFA at the door,
not a second door
The single login carries the strong factors — 6 methods, and which ones are required is decided by the group.
app.acme.in/sign-in
Sign in••••••••••Sign inGroup: Finance · profile 2 of 5TOTPPushBiometricHardware keySMS OTPEmail OTPnot required for this group
Signed in — one screen, two factorsThe password was right.
The laptop was not.
Optionally require an approved device even with perfect credentials.
app.acme.in/sign-in
Sign in••••••••••credentials validSign inMacBook-Air-7F2Anot boundBound devices for this user (2)DESKTOP-4471LAPTOP-9930
One revoke,
everything goes dark
One action removes a leaver from every application, every device and every session already open.
admin.acme.in/people
AAnita R.FinanceActiveRevokedCRMPayrollWikiRepos210live sessionsRevoke access13:42:07 · access removed from 4 applications, 2 sessions closed
Full trail
Login time, result, device, location — written down.
Every authentication through the portal is an event, and every event rolls up. Reportable in the console, exportable to your SIEM in the format it already ingests.
- Who signed in, from which device, in which country
- What was allowed, what was refused, and on which rule
- Which applications a person actually opened last quarter
202 event types
Aggregate access data.
Top apps, devices, users and locations rolled up from every access event — and exportable to your SIEM.
Learn moreOne dashboard
Every door your role opens — behind one of them.
Flip the switch to watch the same person work without it: three apps, three sign-ins, and a reset link somewhere in every one of them.
Alen JosephSigned in once · 08:59
Salesforce
Microsoft 365
GitLab
Slack
Zoom
Workday
Notion
DropboxOne login, every appWork emailalen.joseph@acme.inContinueMFA + device posture
Salesforceopened without a passwordMicrosoft 365opened without a passwordGitLabopened without a passwordWith InstaSafe: one login at 08:59. Everything after it is work, not authentication.
Which applications
If it speaks SAML, it is already on the list.
The logos moving alongside are the ones we are asked about most, not the limit of what we support. Support is a protocol question: anything speaking SAML 2.0, OAuth or OpenID Connect can sit behind this login, which in practice is over 800 business applications.
The ones with their own integration page are simply the ones where setup has a wrinkle worth writing down — a non-standard assertion, a desktop client, a legacy console that never learned SAML at all.
- 800+ SAML, OAuth and OIDC applications
- 3 protocols cover almost all of them
- 1 login in front of every one
Microsoft 365Productivity & Collaboration
Microsoft TeamsProductivity & CollaborationDropboxProductivity & CollaborationSalesforceCRM & Sales
PipedriveCRM & SalesConfluenceITSM & Support
WorkdayHR & Identity
BambooHRHR & IdentityGitLabDeveloper & DevOps
Docker HubDeveloper & DevOps
Google CloudCloud Platforms
FigmaDesign & Productivity
SAPBusiness Applications
DocuSignBusiness Applications
Google WorkspaceProductivity & CollaborationZoomProductivity & CollaborationBoxProductivity & Collaboration
HubSpotCRM & Sales
ServiceNowITSM & Support
ZendeskITSM & SupportSAP SuccessFactorsHR & Identity
Oracle HCM CloudHR & Identity
BitbucketDeveloper & DevOps
Amazon Web ServicesCloud Platforms
VMwareCloud Platforms
CanvaDesign & ProductivityOracleBusiness Applications
Monday.comBusiness ApplicationsSlackProductivity & CollaborationCisco WebexProductivity & Collaboration
NotionProductivity & CollaborationZoho CRMCRM & Sales
JiraITSM & Support
FreshdeskITSM & Support
DarwinboxHR & Identity
GitHubDeveloper & DevOps
JenkinsDeveloper & DevOps
Microsoft AzureCloud Platforms
AdobeDesign & Productivity
MiroDesign & Productivity
QuickBooksBusiness ApplicationsSSO outcomes
One door.Everythingbehind it.
Fifty logins collapse into one, and that one is the login you can afford to defend properly.
The password problem shrinks to one
Defend one login properly instead of fifty badly. Reuse stops mattering when there is nothing left to reuse it across.
Joiner-leaver in minutes
Group membership is provisioning. Disabling the user is offboarding — for every application at once.
Access becomes auditable
Every application login is one line in one log, so the audit question is a report rather than an investigation.
Quick scan
Single sign-on, as a checklist.
Tick what your evaluation actually needs and copy the shortlist straight into your ticket. Filtering hides rows; it never clears a tick.
11 specs · none selected
FAQ
Single sign-on, answered.
Tap a question — our assistant answers on the spot. Still curious? A real human is one click away.
Talk to us//Ready when you are//
Give your team one door.
SSO with MFA and device trust layered into the login itself. See it running on your own applications in 30 minutes.
Already have an IdP? InstaSafe runs as SP behind it