Set up Straza for a team

Every step from an empty host to a governed agent on the enterprise profile, in the order the steps depend on each other.

On this page

Read How it works first if the nouns are new. Each step links the page that does it.

1. Before anything runs
2. Plan your deploymentReferencePick the enterprise profile. It needs Postgres, a public address, one key file for secrets on every replica, a shared NATS server once you run more than one replica, and your identity provider’s issuer and client id.
3. Connect sign-inSectionRegister Straza at Entra ID, Okta or Keycloak, which gives you the issuer and client id the install needs.
4. Install the serverHow-toRun strazad on one host, on Docker, as replicas or with Helm.
5. The first admin
6. Sign in as the first adminNo page yetNobody can sign in before your IGA provisions them, and your IGA needs a token that only an admin can mint. Break that circle once: sign in with the break-glass admin that the first start printed, under Emergency sign-in, or name your own account in oidc.bootstrapAdmin before strazad starts, so your first sign-in at your identity provider makes you an admin. Identity and your IGA explains the order.
7. Mint the admin API tokensHow-toOne for your IGA with SCIM read and write, and one for strazactl.
8. What agents may reach
9. Add the first MCP serverHow-toA role that reaches a server’s tools is made on that server, so the server comes first.
10. Make the rolesHow-toRoles are made in Straza and never by your IGA, so make each role before your IGA can assign it.
11. Write the first policyHow-toOn enterprise, local tools are denied until a policy allows them. Allow what agents need, and hold the risky commands for a person.
12. Who your people and agents are
13. Connect your IGAHow-tomidPoint, Okta or any SCIM system then sends people, agents, sponsors and role membership. Until it has sent a person, sign-in refuses them, because enterprise makes no account at a first sign-in by default.
14. Machines
15. Enroll the first machineHow-toAn admin installs Straza on the machine first, managed and owned by root. The person then runs straza enroll and signs in.
16. Check it end to endHow-toRun the doctor, make one allowed and one denied call, and practice the kill switch.

A step marked No page yet links the page that explains it.

NextRun Straza→