# Identity and your IGA

What your identity provider, your IGA and Straza each decide, and how the first admin signs in.

In short: Your identity provider authenticates people. Your IGA is the source of people, agents, sponsors and role membership, and sends them to Straza over SCIM. Straza defines the roles and decides what each role may do on each call. On standalone, strazad signs people in and an admin creates people and agents in Straza.


Thetablelistswhichsystemanswerseachquestionandwhereitruns.|Thequestion|Whoanswersit|Whereitruns||---|---|---||Whetherthisisreallythe[person](https://docs.straza.ai/concepts/identities/index.md)|Youridentityprovider,suchasEntraID,OktaorKeycloak|Yourcloudtenantoryourownserver,wherethepersonsignsin||Whoexists,which[roles](https://docs.straza.ai/concepts/roles-and-access/index.md)eachholds,andwhosponsorseach[agent](https://docs.straza.ai/concepts/identities/index.md#an-agent)|YourIGA,suchasmidPointorOkta,oranySCIM2.0system|Yourownserverortenant,whichsendseachchangetostrazadoverSCIM||Whateachrolemaydo,oneachcall|Straza|TheStrazaserver,strazad,forcallsto[MCPservers](https://docs.straza.ai/concepts/mcp-apps-and-the-gateway/index.md),andtheStrazaserviceoneachenrolledmachineforlocaltools|Onthestandaloneprofile,Strazaanswerseveryquestionitself.strazadsignspeopleinwithapassword,andanadmincreatespeopleandagentsandsetstheirrolesandsponsors.Strazaleavessign-inandprovisioningtoyoursystemsbecauseyourIGAalreadyrunsthejoiner,moverandleaverprocessesandthecertificationcampaigns.Aseconddirectorywouldcreateoffboardinggaps.AnenterpriseserverthatgetsnousersoverSCIMortheadminAPIthereforehasnobodytogovern.##Sign-inatyouridentityproviderstrazadtrustsoneidentityprovideroverOpenIDConnect.Itreadstheprovider'sdiscoverydocumentatstartupanddoesnotstartwithoutit.Peoplesigninthereinabrowsertoenrollamachineoropentheconsole,soStrazaholdsnopasswordforthemandyourprovider'ssecondfactorapplies.Strazaverifiesthetokenandthenlooksthepersonupamongitsownusers,thesamewayforeveryprovider.Bydefault,asign-inonenterprisecreatesnouser,soStrazarefusesapersonyourIGAhasnotsentyet.Disablingapersonattheidentityprovideronlyblockstheirnextsign-in.Theirenrolledmachineskeepcheckinginwiththemachinekeyuntiltheenrollmentexpires,bydefaultsevendaysafterthesign-inthatcreatedit.OnlythedeactivationfromyourIGAendstheirsessions,soaleaverflowneedsboth.##ProvisioningfromyourIGAYourIGAsendspeople,agents,sponsorsandrolemembershiptostrazadoverSCIM2.0,usinganadminAPItokenthatanadminmintsforit.[midPoint](https://docs.straza.ai/guides/connect-identity/midpoint/index.md)sendspeopleandAIagents,and[Okta](https://docs.straza.ai/guides/connect-identity/okta/index.md)sendspeopleandtheirrolemembership.[AnyotherSCIM2.0system](https://docs.straza.ai/guides/connect-identity/generic-scim/index.md)candothesame.Provisioningdoesnotdependonwhichidentityprovidercheckssign-in,EntraIDincluded.AdeactivationoverSCIMtriggersthe[killswitch](https://docs.straza.ai/concepts/machines-and-sessions/index.md#the-kill-switch).Strazarevokeseverysessionofthatuseroneverymachineanddeletestheuser'sowncredentialsonMCPservers.ASCIMdeleteonlydeactivatestheuser.##WhatyourIGAcanandcannotdoStrazadefinestheroles,andyourIGAassignsthem.SCIMrefusesarequesttocreateordeletearole,andtheerrorsaysrolesaremadeinStraza.EachroleappearsinyourIGAasaSCIMgroup,andgroupmembershipistheroleassignment.Thegroupalsocarriesaread-onlyblockthatsayswhattherolecovers:itskind,theserversandtoolsitreaches,the[objects](https://docs.straza.ai/concepts/objects/index.md)itcoversoneachserver,andthe[policies](https://docs.straza.ai/concepts/policy-model/index.md)thatnameit.Acertifierreadsitbesidethemembers,soareviewshowswhattherolegrantsandwhoholdsit.YourIGAmastersmembershipofeveryrole,straza-adminincluded,soitstokencanmakeanyoneanadmin.Controlwhomayassignstraza-admininyourIGA,whereroleassignmentisdecided.Thebreak-glassadmin,alocalemergencyaccountoneveryserver,isnotexposedoverSCIM,sonoreconciliationcandisableitorremoveitsrole.##ThefirstadminonenterpriseOnanewenterpriseserver,nobodysignsinuntilyourIGAhassentthem,andyourIGAneedsatokenthatonlyanadmincanmint.Yousetupthefirstadminonce,fromthebreak-glassaccountor`oidc.bootstrapAdmin`.Thefirststartcreatesthebreak-glassadminandprintsitspasswordonceinstrazad'slog.SigninwithitunderEmergencysign-inontheconsole'ssign-incard,whichopensStraza'sownsign-inpageforthisaccountonly.Alternatively,set`oidc.bootstrapAdmin`toyourownusernameattheidentityproviderbeforestrazadstarts.Yourfirstsign-intherethenmakesyouanadminandcreatesyouruserifyourIGAhasnotsentityet.Thesettingactsonlyonasign-intheidentityproviderchecked,andonlywhilethebreak-glassadminaloneholdsstraza-admin.Onceanotheradminexists,itdoesnothing.Next,mintthetokenforyourIGAandconnectit,andfromthenonyourIGAdecideswhoholdseachrole.[Keys,certificatesandtokens](https://docs.straza.ai/security/keys-certificates-and-tokens/index.md)coversthebreak-glassaccountanditsrecovery.Howasign-infindsitsuser:Strazafirstlooksforauserwiththetoken'ssubject,butnousercarriesityetunlessyourIGAsentitas`externalId`.Whennonedoes,Strazamatchesthetoken's`preferred_username`tothe`userName`yourIGAsentandrecordsthesubjectonthatuser.Auserboundtoanothersubjectisrefused.Thatstopsasecondaccountattheproviderwiththesamenamefromtakingitover.Anaccountnamedbreak-glassattheidentityproviderisrefusedoneverysign-in,becausethenamebelongstothelocalemergencyadmin.EntraID'sownSCIMprovisioningsendsan`externalId`thatneverequalsthetoken'ssubject,sothe[EntraIDlogin](https://docs.straza.ai/guides/connect-identity/entra-login/index.md)guidehasyouprovisionpeoplewithoutit.Whatprotectsthebreak-glassadmin:Thebreak-glassadminexistsoneveryserverineitherprofile.Strazarefusestodeactivate,lockordeleteitortotakeitsadminrole.Eachinteractivesign-inasthisaccountwritesaloginrecordtotheauditchainandanalarmtostrazad'slog.Ifstrazadstartsandfindsitwithoutitsadminrole,itgivestheroleback.Next:[Tryitonthedemostack](https://docs.straza.ai/evaluate/try-it-on-the-demo-stack/index.md)