Tanflow PAM · Capability
SSO & SAML Federation
Sign in to the PAM gateway through the SAML identity provider your organisation already uses.
Overview
Privileged login through your identity provider
Tanflow PAM registers SAML identity providers for single sign-on. Users authenticate through your corporate IdP, with its policies and MFA, and each enabled provider appears as a sign-in option on the login page.
Register one or more SAML IdPs by issuer and entity ID, and manage each one centrally.
Each enabled provider appears to users as a one-click sign-in choice.
Federated users get the authentication strength, MFA and session policy your identity provider enforces.
Switch a provider on or off in one place, which opens or closes that sign-in route immediately.
Federated SSO and local accounts protected by MFA can both be used, for administrators and break-glass access.
Why it matters
What you can show an auditor
- Privileged login uses the same identity as everything else
- Joiner, mover and leaver changes in the IdP carry through to PAM access
- One fewer set of credentials to manage and secure
Part of Tanflow PAM
This is built into Tanflow PAM, the privileged access platform that needs no agents and deploys on your infrastructure in 2-4 weeks.
Explore the full platform →FAQ
Common questions
Which identity providers are supported?
Any SAML 2.0 identity provider can be registered by its issuer and entity ID and enabled as a sign-in option.
Can we still keep local administrator accounts?
Yes. SAML SSO runs alongside local accounts protected by MFA, which is useful for administrators and break-glass access.
See SSO & SAML Federation in action
A short demo built around your environment and your compliance requirements.