SSO and conditional access
Identity Management with Zero Trust Security
OptyStack is an identity broker for your SaaS apps. It imports users from the identity provider you already use (Google Workspace, Microsoft, or Okta), signs them in to third-party apps like Slack and GitHub, and checks the IP address, device, and region of every sign-in before it lets anyone through.
How does OptyStack broker single sign-on and conditional access?
OptyStack sits between your identity provider and your apps. Users come to OptyStack first, OptyStack checks the conditions you set, and only a sign-in that meets every condition continues to the app. Watch both outcomes below.
Step 1 of 6
Users are imported from your identity provider
OptyStack imports your existing users from Google Workspace, Microsoft, or Okta. No new identities are created in OptyStack.
- 1
Connect your existing identity provider
Link Google Workspace, Microsoft, or Okta to OptyStack. Your provider stays the source of truth for who your people are.
- 2
Import your users
OptyStack imports users from the connected identity source. You do not create or manage a second set of identities in OptyStack.
- 3
Connect your apps
OptyStack becomes the identity provider for third-party apps such as Slack and GitHub, and pushes the imported identities to them.
- 4
Set your conditional access rules
Define the conditions a sign-in must meet: the right IP address, the right device, and the right region.
- 5
Users sign in once through OptyStack
Every sign-in is checked against your rules. If every condition is met the user reaches the app. If any condition fails, access is denied.
What is single sign-on with OptyStack?
Single sign-on with OptyStack means users sign in once at OptyStack and move from there to Slack, GitHub, or any other connected third-party app. OptyStack acts as the identity provider for those apps.
You do not create identities in OptyStack. It brings your users in from Google Workspace, Microsoft, or Okta and then pushes those identities to your third-party apps, so people are the same people everywhere.
No second set of identities
OptyStack brings identities from Google Workspace, Microsoft, or Okta. You keep one source of truth instead of creating users again.
One front door to every app
Users go to OptyStack first and move on to Slack, GitHub, and your other apps from there.
Access decided at sign-in
Conditions are checked on each sign-in, so access depends on where and how someone connects and not only on a password.
How does conditional access work for SaaS apps?
Conditional access means OptyStack checks the IP address, device, and region of each sign-in and grants access only when every condition you set is met. This is zero trust applied to your apps: a valid login alone is not enough, and the context of the request decides the outcome.
Right IP address
Allow sign-ins only from the IP addresses you approve, such as your office network or VPN.
Right device
Allow sign-ins only from devices you approve, so a valid login on an unknown device does not get through.
Right region
Allow sign-ins only from the regions where your team works, and block requests from everywhere else.
All conditions met
The user is allowed through to the application.
Any condition not met
The user is denied access to the application.
Which identity providers can you connect?
You can connect Google Workspace, Microsoft, or Okta as an identity source, and OptyStack imports your users from whichever you run. Your provider stays the source of truth, and OptyStack adds the sign-in and conditional access layer in front of your apps.
The same connections also feed the rest of OptyStack. Identity data powers shadow IT discovery, license management, and the app integrations catalog, so access control and spend control share one picture of your users. See the full OptyStack platform.
FAQ
Identity management and zero trust: your questions, answered.
How OptyStack brokers sign-in, which identity providers it works with, and what happens when a condition is not met.
An identity broker sits between your existing identity provider and your apps. OptyStack imports users from Google Workspace, Microsoft, or Okta, then acts as the identity provider for apps such as Slack and GitHub so users sign in through OptyStack.
Put zero trust in front of your SaaS apps
Connect your identity provider, set your conditions, and let users sign in through OptyStack. Free to start, no credit card required.
Start free trial