> ## Documentation Index > Fetch the complete documentation index at: https://docs.porcia.org/llms.txt > Use this file to discover all available pages before exploring further. # SSO Discovery > Connect your identity provider and your agent discovers every app your team accesses — instantly. # SSO Discovery Connect your identity provider and your agent maps every application your team accesses — who's using what, how often, and what's flying under the radar. ## Why Connect SSO? Find every app your team accesses via SSO See who's using which applications Identify unused licenses and access patterns Discover apps IT didn't know about ## Supported Identity Providers Discover apps accessed via Google SSO **What we discover:** * All SAML and OAuth apps in your Google Workspace * User access patterns and login frequency * Application usage by team member * Third-party app permissions Discover apps accessed via Azure AD / Entra ID **What we discover:** * All enterprise applications in Azure AD * User sign-in activity and frequency * Application usage by team member * Conditional access policies Discover apps accessed via Okta SSO **What we discover:** * All applications in your Okta org * User assignments and access * Login frequency and patterns * Application usage by team member ## How SSO Discovery Works ```mermaid theme={null} graph LR A[Connect IdP] --> B[Sync Apps] B --> C[Track Logins] C --> D[Match Vendors] D --> E[Dashboard] ``` Authenticate with admin credentials and grant read-only access Porcia retrieves all SSO-enabled applications from your IdP Monitor user login events to track actual usage (with consent) Match discovered apps to our global vendor database View all discovered apps, usage patterns, and insights ## What We Discover ### Application Information * **App name and logo** - Visual identification * **Vendor details** - Company behind the app * **Integration type** - SAML, OAuth, OIDC * **Configuration** - SSO settings and policies ### Usage Data * **Active users** - Who's actually using each app * **Login frequency** - How often apps are accessed * **Last login** - When each app was last used * **Usage trends** - Increasing or decreasing usage ### Access Patterns * **User assignments** - Who has access to what * **Unused licenses** - Users with access but no usage * **Shadow IT** - Apps added without IT approval * **Access anomalies** - Unusual access patterns All usage tracking requires user consent and can be disabled in Settings → Privacy. ## Permissions Required ### What We Need All SSO integrations require **read-only admin access** to: * ✅ **Read application catalog** - List all SSO-enabled apps * ✅ **Read user assignments** - See who has access to what * ✅ **Read login events** - Track application usage * ✅ **Read user directory** - Match users to team members ### What We DON'T Need * ❌ **Modify applications** - We never change SSO configurations * ❌ **Manage users** - We never add, remove, or modify users * ❌ **Access credentials** - We never see passwords or tokens * ❌ **Change permissions** - We never modify access controls SSO integration requires admin permissions on your identity provider. If you don't have admin access, ask your IT team to set this up. ## Multi-Provider Support You can connect multiple identity providers simultaneously: ### Common Scenarios **Scenario 1: Acquisition or Merger** * Connect both Google Workspace and Microsoft Entra * See unified view of all applications * Identify duplicate tools across organizations **Scenario 2: Hybrid Environment** * Some teams use Google, others use Microsoft * Connect both to get complete visibility * Consolidate vendor relationships **Scenario 3: Migration** * Migrating from Okta to Azure AD * Connect both during transition * Track migration progress Porcia automatically deduplicates vendors discovered across multiple IdPs. If the same app is found in both Google and Azure AD, it appears once in your dashboard. ## Privacy & Security ### Data Collection * **Application metadata** - App names, logos, vendors * **User assignments** - Who has access (anonymized in analytics) * **Login events** - Timestamps and frequency (no session data) * **Usage patterns** - Aggregated usage statistics ### Data Protection * **Encryption** - All data encrypted at rest (AES-256) and in transit (TLS 1.3) * **Access control** - Only workspace admins can view user-level data * **Audit logs** - Complete audit trail of all SSO sync activity * **Token security** - OAuth tokens stored securely with encryption at rest ### Compliance * **Data privacy** - Right to access, delete, and export data (GDPR compliance in progress) * **User consent** - Usage tracking requires explicit user consent **Security:** Porcia follows industry-standard security practices including end-to-end encryption and role-based access control. Full security documentation coming soon. ## Comparison: Email vs SSO Discovery | Feature | Email Discovery | SSO Discovery | | --------------- | ---------------------- | --------------------- | | Setup time | 2-5 minutes | 5-10 minutes | | Discovery scope | Vendors you email with | Apps accessed via SSO | | Usage tracking | ❌ No | ✅ Yes | | Historical data | ✅ 6 months | ⚠️ Ongoing only | | Admin required | ❌ No | ✅ Yes | | Best for | Vendor communications | Application usage | For complete visibility, use both email and SSO discovery. Email finds vendors you communicate with, SSO finds apps your team uses. ## Disconnecting SSO To disconnect your identity provider: 1. Go to **Settings → Integrations → SSO** 2. Find your connected IdP 3. Click **Disconnect** 4. Confirm disconnection Disconnecting will stop new application discovery and usage tracking. Historical data will be preserved unless you choose to delete it. ## Next Steps Connect Google SSO Connect Azure AD Connect Okta ## Troubleshooting Fix email integration problems Common SSO questions Google Workspace guide Microsoft Entra guide