Identity
Your directory decides who. Inlinea decides what.
People sign in with the identity provider you already run. Groups come from your directory and drive every Access Rule. Administrators get the roles and scope their job needs, and automation gets API users with their own tokens.
Single sign-on
Sign in the way your organisation already does
- Your identity providerMicrosoft Entra ID, Google, Okta, Keycloak, Authentik, Zitadel, JumpCloud, PocketID and any OpenID Connect provider.
- Separate sign-insThe Workspace and the Control Center keep separate sign-ins, each in your branding, and the agent signs a device in through the browser.
- Sign-in protectionTyped credential attempts are limited and abusive addresses are blocked, with named reasons and an unblock action.
- Sign out everywhereOne action ends a person's identity sessions, devices, Secure Sessions and browser sessions.
Directory Sync
Groups from your directory, kept in step
Connect Microsoft Entra ID with the sign-in application you already registered. Users and groups arrive keyed to their sign-in subjects, so the person who signs in is the person the rule names.
- 1ConnectReuse the Entra ID application behind single sign-on; grant it directory read permissions.
- 2Choose scopePick the groups to sync. Members arrive with their groups, and a person's reach follows their membership.
- 3Block, never deleteA user removed or disabled in Entra ID is blocked in Inlinea at the next sync. Nothing is deleted, so audit history stays intact.
- 4See the sourceEvery user shows which identity provider owns it, and the sync's state is visible in the Control Center.
Administration
The right scope for every administrator
- Custom rolesBuild roles from a catalogue of permissions per module: owner, administrator, auditor, or exactly what a help desk needs.
- Delegated scopeGive a regional or departmental administrator the groups, devices and resources of their scope and nothing beyond it.
- API usersService identities with their own access tokens for automation, listed with people in Users and governed by the same roles.
- AuditedEvery administrative action lands in the Audit Log with who, what and when.
Identity providers
What connects, and how
| Provider | Single sign-on | Directory Sync |
|---|---|---|
| Microsoft Entra ID | OpenID Connect | Users and groups, keyed to sign-in subjects |
| Okta | OpenID Connect | SCIM |
| Google Workspace | OpenID Connect | SCIM |
| Keycloak, Authentik, Zitadel, JumpCloud, PocketID | OpenID Connect | Groups through claims |
| Any OpenID Connect provider | OpenID Connect | Groups through claims |
Questions buyers ask
Do we have to move our users into Inlinea?
No. People stay in your identity provider and sign in with it. Inlinea keeps the groups it needs for policy, synced from your directory or read from claims.
What happens to a person who leaves?
Disable them in your identity provider. With Directory Sync they are blocked in Inlinea at the next sync; Live Sessions can also sign them out everywhere immediately.
Can a department administer its own users without seeing everyone?
Yes. Delegated administration scopes a role to chosen groups, devices and resources.
Is there an API?
Yes. A REST API with API users and access tokens covers users, groups, devices, resources, rules and settings.