# Set up Straza for a team

Every step from an empty host to a governed agent on the enterprise profile, in the order the steps depend on each other.


Read[Howitworks](https://docs.straza.ai/evaluate/how-it-works/index.md)firstifthenounsarenew.Eachsteplinksthepagethatdoesit.Beforeanythingruns:-[Planyourdeployment](https://docs.straza.ai/reference/standalone-and-enterprise/index.md):Picktheenterpriseprofile.ItneedsPostgres,apublicaddress,onekeyfileforsecretsoneveryreplica,asharedNATSserveronceyourunmorethanonereplica,andyouridentityprovider'sissuerandclientid.-[Connectsign-in](https://docs.straza.ai/guides/connect-identity/index.md):RegisterStrazaat[EntraID](https://docs.straza.ai/guides/connect-identity/entra-login/index.md),[Okta](https://docs.straza.ai/guides/connect-identity/okta-login/index.md)or[Keycloak](https://docs.straza.ai/guides/connect-identity/keycloak-login/index.md),whichgivesyoutheissuerandclientidtheinstallneeds.-[Installtheserver](https://docs.straza.ai/guides/operate/enterprise-shape/index.md):Runstrazadononehost,on[Docker](https://docs.straza.ai/guides/operate/docker/index.md),asreplicasorwith[Helm](https://docs.straza.ai/guides/operate/kubernetes-with-helm/index.md).Thefirstadmin:-Signinasthefirstadmin(nopageyet):NobodycansigninbeforeyourIGAprovisionsthem,andyourIGAneedsatokenthatonlyanadmincanmint.Breakthatcircleonce:signinwiththebreak-glassadminthatthefirststartprinted,underEmergencysign-in,ornameyourownaccountin`oidc.bootstrapAdmin`beforestrazadstarts,soyourfirstsign-inatyouridentityprovidermakesyouanadmin.[IdentityandyourIGA](https://docs.straza.ai/evaluate/identity-and-your-iga/index.md)explainstheorder.-[MinttheadminAPItokens](https://docs.straza.ai/guides/connect-identity/generic-scim/index.md#mint-a-token):OneforyourIGAwithSCIMreadandwrite,andoneforstrazactl.Whatagentsmayreach:-[AddthefirstMCPserver](https://docs.straza.ai/guides/serve-mcp-apps/add-a-server/index.md):Arolethatreachesaserver'stoolsismadeonthatserver,sotheservercomesfirst.-[Maketheroles](https://docs.straza.ai/guides/serve-mcp-apps/catalogs-per-role/index.md):RolesaremadeinStrazaandneverbyyourIGA,somakeeachrolebeforeyourIGAcanassignit.-[Writethefirstpolicy](https://docs.straza.ai/guides/write-policy/first-deny/index.md):Onenterprise,localtoolsaredenieduntilapolicyallowsthem.Allowwhatagentsneed,and[holdtheriskycommandsforaperson](https://docs.straza.ai/guides/write-policy/hold-for-a-human/index.md).Whoyourpeopleandagentsare:-[ConnectyourIGA](https://docs.straza.ai/guides/connect-identity/midpoint/index.md):midPoint,[Okta](https://docs.straza.ai/guides/connect-identity/okta/index.md)or[anySCIMsystem](https://docs.straza.ai/guides/connect-identity/generic-scim/index.md)thensendspeople,agents,sponsorsandrolemembership.Untilithassentaperson,sign-inrefusesthem,becauseenterprisemakesnoaccountatafirstsign-inbydefault.Machines:-[Enrollthefirstmachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md):AnadmininstallsStrazaonthemachinefirst,managedandownedbyroot.Thepersonthenruns`strazaenroll`andsignsin.-[Checkitendtoend](https://docs.straza.ai/guides/operate/doctor-and-logs/index.md):Runthedoctor,makeoneallowedandonedeniedcall,andpracticethe[killswitch](https://docs.straza.ai/guides/operate/kill-switch-runbook/index.md).AstepmarkedNopageyetlinksthepagethatexplainsit.Next:[RunStraza](https://docs.straza.ai/guides/operate/index.md)