Identity Providers

WitnessAI uses your organization's identity provider (IdP) for single sign-on (SSO), so users sign in to the WitnessAI Console and Secure AI Portal with their existing corporate credentials. Connecting an IdP also lets WitnessAI attribute AI activity to named users and groups, which per-user and per-group policies and analytics depend on.

How it works

WitnessAI supports any standards-based identity provider:

SAML 2.0: the SSO standard used by most enterprise IdPs.
OpenID Connect (OIDC): an authentication layer built on OAuth 2.0.

Any IdP that supports SAML 2.0 or OIDC can be connected. The two provider-specific guides (Microsoft Entra ID and Okta) are worked examples of the most common providers. They walk through each step in that provider's admin console. For any other provider, the same SAML 2.0 or OIDC flow applies, and your WitnessAI account team can help with the provider-specific steps.

During sign-in, your IdP passes WitnessAI a small set of user attributes (email address, first name and last name), which WitnessAI uses to create and identify the user account. Passwords are never shared with WitnessAI. Authentication stays with your IdP.

Single sign-on vs. user provisioning

There are two related but separate integrations:

Integration	What it does	When you need it
Single sign-on (SSO)	Lets users authenticate to WitnessAI through your IdP.	Always. This is the baseline integration.
User provisioning (SCIM)	Automatically syncs users and groups from your IdP into WitnessAI, and disables accounts when people leave.	When you want WitnessAI's user and group lists kept in sync automatically. Required for Witness Anywhere deployments.

Note: System for Cross-domain Identity Management (SCIM) provisioning is required for Witness Anywhere remote-device deployments, because policies are matched to the device user. See the provider guides for SCIM setup.

Two provisioning details to plan for:

Removing a user disables the account but keeps their history. When your IdP reports that a user is gone, WitnessAI disables the account so the person can no longer sign in, and keeps their past conversations, alerts, and analytics intact for investigation and reporting.
Provisioning carries more than name and email. Beyond email and name, SCIM can bring across job title, department, region, country, and manager. These attributes are what let you target policies at organizational groupings rather than listing individuals, so map them in your IdP even if you don't need them yet.

Get started

To begin an identity provider integration, provide your IT administrator's email address to your WitnessAI account team. An invitation to set up the integration is sent from onboarding_idp@witness.ai. When the IT administrator opens the link, they choose their identity provider and follow the guided steps. For provider-specific setup of SSO and, optionally, SCIM provisioning, see the guides below.

Note: If your identity provider is not Microsoft Entra ID or Okta, it can still be connected over standard SAML 2.0 or OIDC. Contact your WitnessAI account team for the provider-specific steps.

Provider guides

Identity Provider Integrations How it works Single sign-on vs. user provisioning Get started Provider guides