External providers offload authentication to a third-party identity provider (IdP) — Microsoft, Google, Okta, ADFS, Auth0, GitHub or any SAML/OIDC-compliant IdP. The user signs in there and the IdP tells ActiveManage who they are.
Benefits
- One password less: Users don't manage a separate credential for your app.
- Centralised lifecycle: Disabling a user in the IdP immediately denies them access here.
- MFA inherited: If the IdP enforces 2FA, you get it for free.
- Audit trail: The IdP's sign-in logs supplement your own.
Generic Setup Pattern
- In the IdP, register ActiveManage as an application. Note the client ID and secret (or upload the metadata XML for SAML).
- In ActiveManage, open Architect Panel → Authentication Methods → Add Provider.
- Pick the provider type and paste the credentials.
- Map IdP attributes (email, name, groups) to user fields.
- Define how groups in the IdP map to security groups in ActiveManage — e.g.
okta-adminsgrants the Admin security group. - Save, then test by signing out and clicking the provider's button on the login page.
Worked Examples
- Azure AD: Staff log in through Microsoft 365. Engineering group in Azure AD → “Developers” security group inside ActiveManage.
- SAML via Okta: A consultancy uses Okta as IdP, with three SAML role attributes determining which projects each consultant can see.
- GitHub: Open-source contributors sign in with GitHub to a partner portal where their GitHub identity is the source of truth.
Tip: Always create at least one local admin password as an emergency break-glass account in case the external IdP goes down. Store it in your team's password manager and rotate after every use.