SSO, passkeys and two-factor authentication

Single sign-on, or SSO, lets members sign in with their usual work account. Learnya supports Microsoft Entra ID and any OpenID Connect compatible provider. People have one less identity to manage, and IT cuts off access at the source when someone leaves.

Preparing the connection

• An application registered with your identity provider, with its client ID and its secret.
• The provider’s OpenID Connect discovery address.
• The redirect address given by Learnya, to be declared with the provider.
• A backup administrator account that does not depend on SSO.

1. With your identity provider, create an OpenID Connect application.
2. Declare the redirect address provided by Learnya in this application.
3. In the authentication settings of the Learnya organisation, choose Microsoft Entra ID or OpenID Connect.
4. Enter the client ID, the secret and the discovery address.
5. Test the connection with a pilot account before opening it to everyone.
6. Tell members the switchover date.

Passkeys

Some accounts do not go through SSO: the backup account, contractors, small organisations. For them, a passkey replaces the password with a check on the device, using the fingerprint, the face or the PIN of the computer or phone. It only works on the genuine Learnya site, which makes it immune to phishing. Register two, on two devices, so that you do not depend on just one.

Two-factor authentication

Two-factor authentication adds a one-time code to the password. Even if the password leaks, sign-in fails without this second factor. Passwords are stored hashed, never in plain text.

• Administrators: a passkey on at least two devices.
• Accounts outside SSO: two-factor authentication at the very least.
• Backup account: passkey kept according to IT’s procedure.
• Every quarter: review of devices and sessions in “Devices & sessions”.