Login and Single Sign-On Setup Guide

This guide explains how your team signs in to Velaro, what Single Sign-On (SSO) adds, which options your plan includes, and what to do first. It is written for workspace administrators. All of these settings live in Settings → Security & Authentication.

How Your Team Signs In

Every person you add under Settings → Team Management gets their own Velaro sign-in. They receive a welcome email, sign in, and are asked to set their own password. Each person signs in with their own account, so Velaro always knows who did what.

If your plan includes Single Sign-On, people can sign in with your company's identity provider instead of a Velaro password. You choose whether SSO is optional or required (see "Login Mode" below).

What Your Plan Includes

Open Settings → Security & Authentication. The Authentication Status card shows your current Login Method and whether Multi-Factor Authentication is Required, Available, or Not included. A feature that is not part of your plan says so on its own card.

• Single Sign-On (SSO): Enterprise plans. Without it, the SSO card says "SSO is not included in your current plan."
• Session Timeout and Concurrent Session Limit: Professional plans and above.
• Agent IP Restriction: Enterprise plans.
• Multi-Factor Authentication: shown on the Authentication Status card. Velaro can turn on enforcement for your site. Ask your account manager.

If you are unsure what your plan includes, ask Moshky or contact your account manager.

Which Option Fits Your Team

Enterprise plan, company uses an identity provider (Microsoft Entra ID, Okta, PingID, PingFederate, OneLogin, or another SAML or OIDC provider): set up SSO. People use the account they already have at work, you manage access in one place, and offboarding someone in your identity provider cuts off new sign-ins.

Enterprise plan, no identity provider: keep the default Velaro sign-in, turn on Session Timeout, and ask your account manager about Multi-Factor Authentication.

Professional plan: use the Velaro sign-in with Session Timeout and the Concurrent Session Limit. If your company needs SSO, an Enterprise plan includes it.

Starter plan: use the Velaro sign-in. Add people only from Team Management, and remove people the day they leave.

Set Up SSO Step by Step

1. Go to Settings → Security & Authentication and find Single Sign-On (SSO).

2. Select Add identity provider.

3. Choose the Provider type: Okta, OneLogin, Microsoft Entra ID (Azure AD), PingID, PingFederate, SAML 2.0 (Generic), or OIDC (Generic OpenID Connect).

4. Enter a Display name your team will recognize.

5. Enter the OIDC discovery URL (it ends in /.well-known/openid-configuration), or the SAML metadata URL for SAML.

6. For OIDC providers, enter the Client ID and Client secret from your identity provider.

7. Enter your company Email domain, for example @yourcompany.com.

8. Select Test next to the URL. A green "Connected" message means Velaro reached your provider.

9. Select Add provider.

Give your IT team this redirect URI to allow in the identity provider: https://login.velaro.com/oauth2/callback. It is the same for every provider.

Provider Notes

Microsoft Entra ID: your IT team provides the Tenant ID (Azure Portal → Microsoft Entra ID → Overview) and the email domain. Microsoft handles the rest.

Okta: create an OIDC Web Application, set the redirect URI above, and copy the Client ID, Client secret, and your Okta domain.

PingID or PingFederate: create an OIDC client, set the redirect URI above, and copy the Client ID, Client secret, and the discovery URL. If your company already signs in to Microsoft with PingID multi-factor, that check happens inside Microsoft's sign-in and works unchanged.

OneLogin: add an OpenID Connect app, set the redirect URI above, and copy the Client ID, Client secret, and subdomain.

Login Mode

Once at least one provider is added, Login Mode appears with three choices:

• Password only: SSO is set up but not required.
• SSO + Password: people choose either method.
• SSO required: people are expected to use SSO. Password sign-in stays available only for people with break-glass access.

Start with SSO + Password. Ask one administrator to sign in with SSO and confirm it works. Then decide whether to require it.

Break-Glass Access

Break-glass access lets a chosen person sign in with their email and password even when SSO is required, so an identity provider outage never locks you out. Turn it on per person: open the user in Settings → Team Management and switch on Break-glass access. Keep it on for at least two administrators and test it before you rely on SSO required.

Removing Someone Who Leaves

Do these on the same day:

1. Block or disable them in your identity provider.

2. Disable them in Settings → Team Management. For people who sign in with SSO, an open Velaro session is blocked within 2 minutes. Other sessions end when they expire.

3. Open Settings → Security & Authentication → Linked sign-in methods and remove any sign-in listed for them.

Do not rely on a Login Mode setting alone to remove access. See the SSO Session Management Guide for the full timeline.

Linked Sign-In Methods

Settings → Security & Authentication → Linked sign-in methods lists any Google, Microsoft or company sign-in that has been linked to your team's accounts: who it belongs to, which method it is, when it was linked, and when it was last used. The list is empty until such sign-ins are in use on your account.

Select Remove next to a sign-in to take that one way of signing in away. The person keeps any other way they can sign in, so disable the person as well when they leave. Every removal is recorded with who did it. When a new way to sign in is added, the person and your administrators receive an email, so you can remove one you do not recognize.

Common Questions

Do all of our agents have to use SSO? No. You choose the Login Mode. "SSO + Password" lets people use either.

Can some people use SSO and others not? Yes, with "SSO + Password", or with break-glass access when SSO is required.

Do we need to set up SSO to try Velaro? No. SSO is for teams that want to manage sign-in through their own identity provider.

A person is told "No account found." An administrator must add them under Settings → Team Management first. Signing in with a work account does not create a Velaro user by itself.

SSO says "Not included in your current plan." SSO is part of Enterprise plans. Contact sales@velaro.com.

Adding an identity provider says it is reserved, or already registered by another customer. Microsoft, Google, Facebook, Apple and Velaro's own sign-in addresses cannot be added as a custom provider; use the Microsoft Entra ID provider type for Microsoft work accounts. If another Velaro customer has already registered the same provider address, contact Velaro support so the registration can be verified.

I turned on SSO required and cannot sign in. Use an account with break-glass access, then switch Login Mode back to SSO + Password and check the provider with Test.