How do I set up SSO and SCIM?

Tango uses a third-party service called Frontegg to handle the SSO/SCIM connections for our users. This means that the SSO flow and verification goes through Frontegg and gets passed back to Tango.

When you’re ready to configure SSO, Tango will enable your Workspace’s connection to Frontegg. This workflow will walk you through the SSO configuration process (please note that while we use Okta as the example in this workflow, the actual in-app support documentation will be customized to your IdP).

Any SAML or OpenID SSO services are supported. There is built-in documentation for a number of these services, as well as an option for Custom App configuration which covers anything not specified.

There are a number of access requirements the person configuring SSO should meet:

As long as the person configuring SSO has the correct Admin credentials to complete the required steps, SSO can be set up in less than 20 minutes.

You will need..

SCIM is included in some Enterprise contracts. If it is not included in your Enterprise plan, it can be added at an additional cost.

The main benefit of SCIM is centralizing role management, provisioning, and deprovisioning of users. Provisioning and deprovisioning are hugely important to security in access management, because they mean that you don’t have to manually remove users who no longer should have access across all your platforms.

Once SSO and SCIM have been set up, Tango Admins who do not have access to manage users in the IdP will not be able to add or remove users within Tango. This is a security bonus, but may make role management more burdensome if you plan to rotate who has access to the Tango Workspace.

As long as the person configuring SSO has the correct Admin credentials to complete the required steps, SCIM can be set up in under an hour, including setting up groups and assigning roles. It may take additional time to sync after the SCIM configuration is complete, depending on the settings within your IdP, but the initial setup is fairly quick.

Tango will only look for attributes for username, email, first name, and last name. These specific mappings should be within the SCIM configuration documentation when you are setting up SCIM.

Specifically for Azure, externalId is needed as one of the attributes, so please do not remove it.

We do not prevent the manual assignment of roles once SCIM has been set up, so role management is done through the "Members" section of your Workspace's settings.

No. Only applications approved by Google can use SCIM for Google SSO. Unfortunately, Tango is not currently on that list so it is not possible to use SCIM with Google SSO at this time. We do not expect that to change in the near future.

In addition to the self-serve documentation provided, Tango has a dedicated Technical Support Engineer, as well as two Staff Engineers who are experts in configuring SSO and SCIM. Should Business or Enterprise clients require help in setting up their SSO or SCIM connections, they can email [email protected] or [email protected] to schedule time with a member of our team.