Your hosted SSOGEN organization: SaaS SSO operated by SSOGEN

Who this page is for: the administrator of an organization on the SSOGEN hosted service. What you need first: nothing; read this before First sign-in and setup. Result: you know which pages of the Admin Console you will and will not see, which settings have extra rules on the hosted service, and whom to ask when a feature is not switched on.

This page uses the fictional company Acme Corp, whose organization’s address is written as https://acme.example. Your own address is assigned by SSOGEN when your organization is created and is in your invitation email.

What the hosted service is

On the hosted service, SSOGEN runs the software and you get an organization: your own address, your own sign-in page, your own Admin Console, your own people, applications, policies and audit log. Nothing of your organization is shared with another customer: every organization has its own signing keys, its own secrets vault and, once Gateways are switched on, its own certificate authority for Gateways and agents.

The Admin Console, the sign-in page, My Apps and the Authenticator app are the same as on an SSOGEN you run yourself, so every other page of this documentation applies, with the differences below.

What you manage and what SSOGEN manages

You manage	SSOGEN manages for you
Administrators and their roles (Settings > Admin roles)	The servers, the database, backups and upgrades
People, groups and attributes (Identity)	The HTTPS certificate of your address
Directories and identity providers (Identity > Directories, SSO policies > Identity providers)	Your organization’s signing key and AI agent key
Sign-in policies, second factors, password policy	The mail service that sends your codes, links and notices, unless you connect your own mail server
Applications, assignments and the App gallery (Applications)	Which features are switched on for your organization (see below)
Branding (Settings > Branding)	The relay your Gateways can dial out to
Your own Gateways, when switched on (Secure access)	Your organization’s certificate authority for Gateways, Web Agents and the Directory Connector
Webhooks, audit review, sessions (Monitoring)	Service logs, database statistics and server findings (not shown to you)

On Monitoring > System health, the items SSOGEN takes care of read SSOGEN manages this for your organization: HTTPS certificate, Signing key, AI agent key and Client address.

Your organization’s address

Your address is fixed when the organization is created. It cannot be changed afterwards, and the hosted service does not offer sign-in under a domain name of your own.
The address is where your people sign in and where any Gateway or Web Agent of yours enrols. Use it exactly as written in the invitation, with https://.
Setup and the mailed links described below work only when opened at that address. Opened anywhere else, the page answers Open this page at SSOGEN’s own address, then try again.

Features switched on per organization

Some features are switched on for an organization by SSOGEN, not by you. Until a feature is on, its pages are left out of the Admin Console menu, and a request that needs it is refused with the message This feature is not enabled for your organization.

Feature	What it gives you	Menu pages that appear when it is on
Gateways	Your own SSOGEN Gateways enrol against your address: App Proxy, Directory Connector, Outbound Connector	Secure access > App Proxy routes, Directory Connector, Gateways; Applications > App Proxy
App Proxy certificates	Certificates for the hostnames your Gateways serve	Secure access > App Proxy certificates (with Gateways)
Remote Access	SSH, RDP and VNC sessions through your Gateways	Secure access > Remote Access (with Gateways)
Outbound Connector	A Gateway inside a private network that dials out	Secure access > Outbound Connector (with Gateways)
Web Agents	Apache and Java agents in front of your own web servers	Applications > Web Agents, Applications > Java Agents
Directories	LDAP directories for sign-in and sync	Identity > Directories
Kerberos	Windows desktop sign-in	Part of identity connections; refused until on
Own mail server	Mail sent through your own mail server instead of SSOGEN’s	Settings > SMTP
Text message codes	Second-factor codes by text message	Settings > SMS
Email codes	Second-factor codes and recovery by email	No page of its own; the option is offered once on
MCP servers	AI-agent access through SSOGEN	AI agents > MCP servers

How to see what is on for your organization:

Open Monitoring > System health.
Find Features switched off for your organization. It reads Every feature is available to your organization., or These features are not switched on: …. Ask SSOGEN to switch on any you need. followed by the list.

If you open a page of a feature that is off by its address, it shows only the page title and This feature is not enabled for your organization.

When SSOGEN switches a feature off after you used it, its pages stay in the menu for review, with the notice This feature is not enabled for your organization. What was set up while it was on is no longer used. You can review it here and remove it. Controls that would add or create something are hidden there; when nothing is left the page reads Nothing to remove. A Gateway or agent enrolled under a feature that is switched off is refused at its next call, keeps its keys, and works again when the feature is switched back on.

What behaves differently

Email

Mail from your organization (codes, reset and sign-in links, invitations, approval and expiry notices) is sent by SSOGEN’s mail service. You do not have to set up a mail server. The sender’s display name is your organization’s name as SSOGEN recorded it, not the text on your Branding page, and replies go to your organization’s owner contact.
The mail service has daily limits per organization and per recipient. Codes and reset links have a quota of their own, and so do emailed sign-in links, so invitations and notices can never use them up. A message over a limit is not sent and not queued; the person is told to try again.
With Own mail server switched on, Settings > SMTP accepts only: port 465 or 587; Connection security set to STARTTLS required (port 587 or 25) or TLS from the start (port 465), never None (only a mail server on this machine); a mail server at a public address; a From address that is not under SSOGEN’s own domains; a password stored as a secret, not typed in a setting. A setting outside these rules is refused with This mail setting is not allowed for this deployment. and the field named. Port 25 is refused even though the label mentions it.
When SSOGEN publishes the fixed addresses its mail connections come from, Settings > SMTP shows them under Allow these addresses on your mail server’s firewall: SSOGEN connects to it from them.

Invitations work on a hosted organization as soon as you sign in; the invitation email is sent from the hosted service’s address. Self-service registration (Create an account on your sign-in page) is turned on for your organization by SSOGEN, at your request.

Until SSOGEN turns it on, Identity → Sign-up → Settings cannot save Allow people to create accounts.
Your organization has a daily and a total limit on accounts created by sign-up, set when sign-up is turned on. SSOGEN can change them for your organization.
When a limit is reached, the sign-in page stops offering Create an account and no sign-up email is sent until the limit allows it again.
SSOGEN can stop sign-up for your organization at once, for example during an abuse report. The settings page then reads Sign-up is turned off for this organization by your service provider.
Security notices have a mail quota of their own, so invitations and sign-up emails never crowd them out.

Everything else (entries, approval, the applications-only rule, the limits per address, domain and network) is the same as on an SSOGEN you run yourself.

Directories

A directory must be reachable at a public address on port 636 or 3269 (LDAPS) or 389 or 3268 (StartTLS). A directory on your private network cannot be used for sign-in from the hosted service; the test answers This directory address cannot be reached from this service. Use your directory’s public address: sign-in cannot use a directory on a private network. A wrong port answers Use port 636 or 3269 for LDAPS, or 389 or 3268 for StartTLS.
Directory tests are limited per organization: Too many directory tests were run; wait a minute and try again.
A directory bind password must be a stored secret (Settings > Secrets), never an environment reference.
A Directory Connector Gateway lets SSOGEN test a connection to a directory on your network without an inbound port, but sign-in does not use it (the token form says so).
When SSOGEN publishes its fixed outbound addresses, Identity > Directories shows them under Allow these addresses on your directory’s firewall: SSOGEN connects to it from them.
With Directories switched off, an existing directory connection can still be read, switched off, archived or deleted, but not changed, tested or activated.

Identity providers

For an OpenID Connect or SAML provider, Second factor after sign-in with this provider does not offer Never ask: the provider is the only factor; the option reads Not available on a shared installation. SSOGEN’s second factor is always available as a fallback. Kerberos (Windows desktop sign-in) needs the Kerberos feature on, a keytab stored as a secret, and a service name on your organization’s own address.

Secure access and Gateways

Each organization runs its own Gateways at its own address; no Gateway is shared between organizations. See Run a Gateway with a hosted organization.
The Gateways page has no Replace Gateway keys now button; SSOGEN rotates your organization’s keys and authority.
Relay registrations are not on the App Proxy route’s Uplink relay section; your registrations are handled for you by SSOGEN.
Under Applications > Connections, Private delivery always reads Not allowed: an application connected this way cannot be delivered to a private address from the hosted service.

Pages you will not see

Monitoring > Logs (service logs belong to the service, not to one organization).
Database size on System health; the database section shows Reachable: yes only.
Server findings on the Overview and on Settings > Certificates.

Limits

An organization has limits on the number of people, applications and connections it can hold. When a limit is reached, creating one more is refused. Ask SSOGEN if you reach one.

Owner contact

Your organization has an owner contact, the email address that received the invitation. It is used for replies to your organization’s mail and for notices about the organization. A change of owner contact is started through SSOGEN; both the old and the new address receive an email with Confirm owner contact and Cancel this change links, the new address must confirm, and the change takes effect 72 hours after it does. Anyone notified can cancel until then. The confirm page says Your address is confirmed. The change takes effect 72 hours from now unless someone cancels it.; the cancel page says The change was canceled. Nothing was changed on your tenant. (the word tenant in these pages and emails means your organization).

Data

There is no self-service export of an organization’s data on the hosted service. Ask SSOGEN if you need one.

Check it worked

Sign in to the Admin Console at your address.
Open Monitoring > System health: the four managed items read SSOGEN manages this for your organization, and Features switched off for your organization lists what is not on.
Open the menu: the groups and pages match the feature list above.

Troubleshooting

What you see	Why	What to do
This feature is not enabled for your organization.	The feature is switched off for your organization.	Ask SSOGEN to switch it on. Check System health for the list.
A page is in the menu but reads What was set up while it was on is no longer used.	The feature was switched off after you used it.	Review and remove what is left, or ask SSOGEN to switch it back on.
This mail setting is not allowed for this deployment.	Port, connection security, server address, sender or password form outside the hosted rules.	Use port 465 or 587 with TLS, a public mail server, a sender under your own domain and a stored secret.
This directory address cannot be reached from this service.	The directory is on a private network.	Publish the directory at a public address with LDAPS, or use another sign-in method.
Too many directory tests were run; wait a minute and try again.	The per-organization test limit.	Wait a minute.
Not available on a shared installation.	Skipping SSOGEN’s second factor for a provider is not offered.	Keep one of the other two options.
Open this page at SSOGEN’s own address, then try again.	A setup or mailed link was opened at another address.	Open the link from the email again.
This service is suspended.	Your organization is not in service.	Contact SSOGEN.
Creating a person, application or connection is refused with no field named	A limit of your organization is reached.	Ask SSOGEN.