Overview

AppNavi provides several authentication options for securing access to the Portal and AppNavi Avatar. The appropriate setup depends on how your organization manages user identities and the level of security required.

Authentication at a Glance

SSO uses the OpenID Connect (OIDC) protocol and can integrate AppNavi with supported identity providers such as Microsoft Entra, Google, or Okta.

Before You Configure Authentication

Make sure you have:

• Tenant Owner or administrator access to Manage Tenant settings.
• A clear decision about whether users will use AppNavi credentials or an external Identity Provider.
• The required Identity Provider details if SSO is being configured.
• An authenticator application if MFA will be enabled.
• The email domains that should be allowed if Domain Restriction is required.
• Test users available for validating the configuration.

Important: MFA can be enabled for individual users only after MFA has been activated at the tenant level.

Choose an Authentication Approach

Option 1: Username and Password

Use this approach when users should authenticate directly with their AppNavi username and password.

Basic flow:

User opens AppNavi → enters username and password → AppNavi validates the credentials → user accesses the Portal or Avatar.

Choose this option when your organization does not require an external Identity Provider.

Option 2: Single Sign-On

Use SSO when your organization already manages user identities through an external Identity Provider.

AppNavi supports OIDC-based authentication. The Identity Provider authenticates the user, and AppNavi receives the required authentication information and user claims.

Basic flow:

User opens AppNavi → AppNavi redirects to the configured IdP → user authenticates with the organization → IdP returns the authentication result → user accesses AppNavi.

When configuring SSO, the administrator provides the required provider information, such as authentication and token endpoints, Client ID, scopes, and claims.

After saving the configuration, use Test Configuration where available to verify the OIDC setup before asking end users to sign in.

Portal and Avatar Login

Authentication can affect both the AppNavi Portal and the AppNavi Avatar.

• Portal: Users authenticate when accessing the AppNavi management interface.
• Avatar: Users authenticate when accessing AppNavi functionality inside an integrated application.
• SSO: Can be used for both Portal and Avatar login.
• Domain Restriction: Applies to both normal and SSO login for Portal and Avatar.

Add Multi-Factor Authentication

MFA adds an additional verification step to the login process.

Setup order

1. Open Manage Tenant.
2. Enable MFA at the tenant level.
3. Activate MFA.
4. Open the required user account.
5. Enable MFA for the user.
6. Have the user complete the authenticator setup and verification during login.

The user must provide a verification code in addition to the normal login credentials.

Expected result: The selected user is prompted for an MFA verification code when signing in.

Restrict Login by Domain

Domain Restriction limits access to users whose email addresses belong to configured domains.

1. Open Manage Tenant → Settings.
2. Enable Domain Restriction.
3. Add the permitted email domains.
4. Save the configuration.
5. Test login with an allowed user.
6. Test login with a user from an unauthorized domain.

AppNavi supports up to 10 configured domains at a time.

Expected result: Users with an authorized domain can sign in, while users with an unauthorized domain are denied access.

Automatically Log Out Inactive Users

Use Auto Logout when inactive sessions should expire automatically.

The feature is configured at the tenant level and logs users out after the configured period of inactivity.

Expected result: An inactive user receives the logout reminder and is automatically logged out when the configured inactivity period is reached.

Validate Your Authentication Setup

After configuring authentication, verify the complete login flow with a test account.

Validation checklist:

• Confirm the user can access the intended AppNavi Portal or Avatar.
• Confirm the selected authentication method is displayed or triggered as expected.
• If SSO is enabled, confirm the user is redirected to the configured IdP.
• If MFA is enabled, confirm the verification code is requested.
• If Domain Restriction is enabled, confirm an authorized domain can log in.
• Confirm an unauthorized domain is denied access.
• If Auto Logout is enabled, confirm the configured inactivity behavior works as expected.

Which Approach Should You Use?

Use Username and Password when AppNavi should manage the direct login experience.

Use SSO when your organization already has an Identity Provider and wants users to authenticate through their existing corporate accounts.

Add MFA when an additional verification factor is required. MFA can be combined with the applicable login method.

Add Domain Restriction when access must be limited to specific organizational email domains.

Add Auto Logout when inactive sessions should automatically expire.

These options can be used together where supported. For example, an organization can use SSO for authentication, MFA for additional verification, Domain Restriction to limit eligible users, and Auto Logout to control inactive sessions.

Related Authentication Guides

See the dedicated guides for detailed configuration instructions:

• Single Sign-On / OIDC
• Single Sign-On with Microsoft Entra
• Single Sign-On with Okta
• Single Sign-On for Avatar
• 2 Factor Authentication
• Domain Restriction
• Auto Logout
• End User Authentication