GDesk – SSO & 2FA

Microsoft Azure AD (OIDC)

Connected

Tenant ID

Client ID

Client Secret

Redirect URI (copy to Azure)

Scopes

openid profile email User.Read GroupMember.Read.All

SSO Behaviour

Force SSO login (disable email/password)

Auto-provision new users on first login

Sync user profile on every login

Disable account when removed from Azure AD

SSO Statistics

SSO Logins Today183

Failed Logins (24h)3

Linked Accounts216/218

Last Token Refresh4 min ago

Quick Actions

Test SSO Flow

Test with User Email

OIDC Configuration Valid

Tenant ID, Client ID and Redirect URI are correctly configured

Azure AD Reachable

login.microsoftonline.com responded in 142ms

User Found in Azure AD

ahmed@gulftech.sa — Display name: Ahmed Al-Rashidi

Group Memberships Retrieved

Groups: IT-Staff, All-Employees — mapped to: Agent, IT Support

Token Exchange Successful

Access token and ID token issued successfully

GDesk Session Created

User would be logged in as Department Admin · IT Support

All 6 SSO checks passed. Configuration is working correctly.

Azure AD Group → GDesk Role Mapping

Azure AD Group	GDesk Role	Department	Auto-assign
`IT-Staff`	Agent	IT Support	Yes
`IT-Manager`	Dept Admin	IT Support	Yes
`HR-Staff`	Agent	HR Department	Yes
`Finance-Team`	Agent	Finance	Yes
`All-Employees`	Employee	—	Yes
`GDesk-SuperAdmin`	Super Admin	—	Yes

Override manual role assignments on SSO login (group mapping takes precedence)

SCIM Provisioning (Azure AD → GDesk)

SCIM enables automatic user provisioning and deprovisioning from Azure AD. Configure the SCIM endpoint in your Azure enterprise app.

SCIM Endpoint URL

Bearer Token

Provisioning Settings

Auto-create users on provisioning

Auto-deactivate users on deprovisioning

Sync user attributes on update

Recent Provisioning Events

Event	User	Time	Status
Create	nora@gulftech.sa	2h ago	Success
Deprovision	john@gulftech.sa	2 days ago	Success
Update	sara@gulftech.sa	5 days ago	Success

Two-Factor Authentication Policy

Platform 2FA Requirement

Optional — users choose whether to enable

Required for Agents & Admins — employees optional

Required for All Users

Grace Period

New users have this many days to enroll in 2FA before being locked out

days

Role-based Overrides

Role	2FA Requirement	Allowed Methods
Employee	Optional	TOTP, SMS, Email
Agent	Mandatory	TOTP, SMS
Dept Admin	Mandatory	TOTP only
Super Admin	Mandatory	TOTP only

Remember Device

Allow users to trust a device for

days

Enabled 2FA Methods

TOTP (Authenticator App)
Google Authenticator, Microsoft Authenticator, Authy

OTP Length

OTP Validity

SMS OTP
One-time code sent via SMS (uses Twilio)

Code Length

Expiry

Email OTP
One-time code sent to work email

Only allowed for Employee role (not Agents or Admins)

83%

Overall 2FA Adoption

100%

Agents Enrolled

76%

Employees Enrolled

37

Not Enrolled

2FA Adoption by Department

IT Support100%

Finance94%

HR Department88%

Facilities71%

Procurement62%

Reset User 2FA

Search User

AR

Ahmed Al-Rashidi

ahmed@gulftech.sa · 2FA: TOTP

Enrolled

Reset Action

Reset 2FA — user must re-enroll on next login

Bypass 2FA for next login only (one-time)

Reason (for audit log)

Backup Codes Policy

Allow Backup Codes

Users can generate backup codes as 2FA fallback

Number of Codes per Generation

Code Format

8-character alphanumeric pairs

Roles Allowed to Use Backup Codes

Employee

Agent

Department Admin (TOTP only recommended)

Super Admin (TOTP only recommended)

Backup codes are single-use. Each code is invalidated after use. Admins can view usage in the audit log.