The standard setup includes one Identity Provider per company. However, the Cyber Guru platform supports some more complex scenarios. If you fall into one of these cases, please notify Cyber Guru before starting the configuration: the sequence of steps will be different.
1. Two Entra ID tenants (or two authentication domains) for the same company
When this applies: The organization has two separate Microsoft Entra ID tenants—typically after a merger or when there’s a subsidiary—but wants a single Cyber Guru company, with unified reporting and gamification.
How it works: The company remains unified; two SSO connections are set up, and the login page will show two login buttons, one for each tenant. Each user selects the button for their organization.
What we need from you:
- The IdP metadata for both tenants (a SAML application for each, configured as in the standard guide);
- An indication of which users belong to which tenant.
Important: Users must be registered on the IdP with the correct domain. A user on the wrong tenant, or with a mismatched email domain, will not be able to log in.
2. Second Identity Provider on the same company
When this applies: Temporary coexistence of two identity systems (e.g., during a migration from ADFS to Entra ID), or user groups managed by different IdPs.
How it works: Cyber Guru sets up a second SAML connection on the same company. You’ll be given a second SP metadata URL, different from the first, to use when configuring the application on the second IdP.
| ⚠️ | For each IdP, use exactly the SP metadata URL provided for that connection. Reusing the first connection’s URL is a common mistake in this scenario and will cause authentication failures that are hard to diagnose. |
Note on migrations: If a user needs to move from one IdP to another, the link to their previous identity must be removed from Cyber Guru. Plan your migration in advance: see SSO Maintenance.
3. IdP-initiated access (from the Identity Provider portal)
When this applies: You want users to access Cyber Guru by clicking an icon in the IdP’s app portal (the Google Workspace app panel, Microsoft’s My Apps), without going through the platform’s URL.
How it works: This is technically different from platform-initiated login (SP-initiated) and requires a dedicated ACS endpoint, different from the one used in the standard setup. Cyber Guru will provide this upon request.
What to do: Open a support ticket.
4. Multiple Cyber Guru companies on the same IdP tenant
When this applies: The organization has multiple separate Cyber Guru companies (for example, one for the standard track and one for a NIS2 track, or one for each group company) but only one IdP tenant.
How it works: Each company has its own SP metadata URL. On the IdP, you’ll typically need separate SAML applications, one for each company, each with its own group of authorized users.
Important: A user who needs access to two companies must be assigned to both applications. Double-check the mapping between groups and companies: it’s easy to assign users to the wrong app.
5. Multiple organizational classifications
You can send as many classifications as you need as organizations, in the format org_{ORG_NAME}: location, department, organizational unit, division, and so on. On the platform, these become filters for dashboards and reports, and one of them can be designated as the Team for gamification purposes. See Identity Provider SSO Attributes.
6. Very specific attributes or automatic provisioning
If you need to bring attributes into the platform that don’t fit the organization model (employee ID, tax code, training credits) or want to automatically sync the user lifecycle—creation, update, deactivation—SSO is not the right tool: SAML only transmits information at login and does not notify the platform when a user is disabled.
In these cases, consider provisioning via SCIM 2.0 or using the API, alongside SSO for authentication. If SCIM is not available, deprovisioning methods should be agreed with Cyber Guru. This choice must be made before go-live, as it affects how users are populated.
7. Single Logout (SLO)
Some Identity Providers handle logout in ways not covered by the default configuration. If you encounter errors or sessions that remain open after logging out of the platform, let us know: this requires a configuration change on the Cyber Guru side, not on your IdP.