---
title: "Federated authentication"
url: "https://docs.yugabyte.com/stable/yugabyte-cloud/managed-security/managed-authentication/federated-entra/"
---

# Federated authentication

Use federated authentication for single sign-on.

Single sign-on using an identity provider

Using federated authentication, you can use an enterprise IdP to manage access to your YugabyteDB Aeon account. After federated authentication is enabled, only Admin users can sign in using password authentication.

Currently, YugabyteDB Aeon supports IdPs exclusively using the OIDC (OpenID Connect) protocol.

- [Microsoft Entra](/stable/yugabyte-cloud/managed-security/managed-authentication/federated-entra/)
- [PingOne](/stable/yugabyte-cloud/managed-security/managed-authentication/federated-ping/)
- [Okta](/stable/yugabyte-cloud/managed-security/managed-authentication/federated-okta/)
- [JumpCloud](/stable/yugabyte-cloud/managed-security/managed-authentication/federated-jump/)
- [Custom](/stable/yugabyte-cloud/managed-security/managed-authentication/federated-custom/)

## Prerequisites

Before configuring federated authentication, be sure to allow pop-up requests from your IdP; the provider may need to confirm your identity in a new window.

## Register an application with Microsoft identity platform

Before enabling federated authentication in YugabyteDB Aeon, you must configure your IdP and obtain the necessary credentials.

To use Entra for your IdP, you need to register an application with Microsoft Entra so the Microsoft identity platform can provide authentication and authorization services for your application.

Configure the application as follows:

1. In Azure Portal, navigate to **Microsoft Entra ID**.
2. Click **+ Add > App registration**.
3. Provide a name for the application.
4. Under **Supported account types**, choose **Multiple Entra ID tenants** and select **Allow all tenants**.
   
   ![Entra account types](/images/yb-cloud/managed-authentication-azure-account-types.png "Entra account types")
5. Set the **Redirect URI** to **Web**, and the URI to the following:
   
   ```sh
   https://yugabyte-cloud.okta.com/oauth2/v1/authorize/callback
   ```
6. Click **Register**.

Use your own Entra account to test the connection. For more information, refer to [Register an application with the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app "Register an application with the Microsoft identity platform") in the Microsoft documentation.

In addition, to configure Entra federated authentication in YugabyteDB Aeon, you need the following:

- Client ID of the application you registered.
- Client secret of the application.

Refer to [Create a new client secret](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#option-3-create-a-new-client-secret "Create a new client secret") in the Microsoft documentation.

## Configure federated authentication

To configure federated authentication in YugabyteDB Aeon, do the following:

1. Navigate to **Security > Access Control > Authentication** and click **Enable Federated Authentication** to display the **Enable Federated Authentication** dialog.
2. Choose the Microsoft Entra ID identity provider.
3. Enter your Entra application client ID and secret.
4. Click **Enable**.

At this point, you will be redirected to sign in to your IdP to test the connection. If the test connection is successful, federated authentication is enabled.