Configure SSO for system user login

For system users signing in to the HP Insights web console

This document covers SSO for system users signing in to the web console. System users are administrators with elevated permissions who sign in to the HP Insights web console to configure and manage the system.

Overview

System users sign in to the HP Insights web console using one of three authentication provider types: Internal, SAML, or OpenID Connect. Which one fits depends on whether your organization uses an external identity provider and how you want to manage user accounts.

If you're using an external identity provider, you also need to decide how system user accounts are provisioned. SCIM handles this automatically. Without SCIM, you create and manage accounts manually.

Two ways to configure SSO

HP Insights has two SSO configurations for system users, and only one can be active for an organization at a time.

Admin SSO is the current approach, configured under Account Settings > Settings > Admin SSO. It is a wizard that reuses the User Authentication Providers configuration on the same Settings page, so the identity provider is set up once and applies to both system users and print users. Admin SSO pairs with SCIM, which provisions system user accounts, roles, and group membership automatically from your identity provider.

Legacy SSO is the older approach, configured under Account Settings > Single Sign-on Configuration. It has its own configuration section (also named User Authentication Provider), separate from print user authentication, and system user accounts are created and managed manually under Users > System Users.

Benefits of SSO

Works with any SAML 2.0 or OpenID Connect identity provider, including Microsoft Entra ID, Google, etc.
System users sign in with their existing organization credentials. No separate HP Insights passwords to remember.
Credentials stay in the identity provider. HP Insights doesn't store or manage passwords for SSO-enabled users.

Choose an Authentication Provider

Find the row that matches your situation. The provider type and provisioning method together determine where you configure SSO and how user accounts are managed.

If your organization doesn't have an identity provider, use Internal authentication — it's the default for system user login and needs no configuration. See Internal authentication for system user login.

Authentication provider	Provisioning	When to use it	Where it's configured
SAML 2.0 or OpenID Connect with SCIM	Automatic	You have an identity provider and want user accounts, roles, and group membership managed there automatically. Choose SAML if your org already has SAML in place. Choose OIDC for modern cloud IdPs like Entra ID or Google.	Account Settings > Settings > Admin SSO (wizard with links to each step). Step 1 takes you to User Authentication Providers on the same Settings page, shared with print user authentication.
SAML 2.0 (Legacy SSO)	Manual	You have SAML in place but have a small team and don't need automated provisioning. You'll create and manage system users manually.	Account Settings > Single Sign-on Configuration. Create and invite system users manually in Users > System Users.
OpenID Connect (Legacy SSO)	Manual	You're on a modern cloud IdP and have a small team. No automated provisioning needed and no certificate rotation to manage.	Account Settings > Single Sign-on Configuration. Create and invite system users manually in Users > System Users.

Note: Admin SSO (SCIM) and Legacy SSO can't be active at the same time. When Admin SSO is enabled, the Single Sign-on Configuration tab is visible but inactive and shows "This feature is not applicable."

Where to go next