DATASHEET

Automated Provisioning

Automated Provisioning with Keeper Enterprise

Keeper’s Automated Provisioning

Keeper Security transforms the way businesses and individuals
protect their passwords and sensitive digital assets to significantly
reduce cybertheft and increase online productivity. As the leading
password manager and digital vault, Keeper helps millions ofpeople and thousands of businesses substantially mitigate the riskof a data breach.

One of the most important ways to ensure compliance andsimplify the rollout and onboarding of Keeper Enterprise isthrough the use of automated provisioning methods. KeeperEnterprise integrates with both on-premise and cloudbased directory services for the automated deployment andprovisioning of password vaults. With Keeper’s automatedprovisioning methods, IT Admins can deploy end-user vaults
without having to manage yet another directory of users.

Migration Towards Unified Directory Services
Identity and access teams strive to build and maintain a unified
corporate directory structure that can be utilized across bothon-prem and cloud-based infrastructure. Active Directory has
been traditionally used in Microsoft-centric environments tocontrol access to resources. As more enterprises move to thecloud, migrations from on-prem AD to Azure AD or a replication
between the two environments has been taking place. DirectoryAs-A-Service (DaaS) products have emerged which unify diverse
requirements into a single unified directory.
IT Admins don’t want to maintain multiple directory services
because it introduces operational complexity, inefficiencies andsecurity vulnerabilities. Controlling access to corporate resources
and removing access in an efficient and timely manner is criticalfor compliance and protecting against data breaches.

Auto-Provisioning Features•

User onboarding and offboarding•

User authentication through SAML 2.0•

Integration with SCIM•Team creation and management•

Role enforcement policy management•

Access to shared team folders

SCIM (System for Cross-Domain Identity Management)
Keeper supports SCIM 2.0, a REST-based API using JSON message structure. The Keeper SCIM endpoint
supports Users and Groups resources, and the below message types:

Base ProductTeams

Retrieve user information

Retrieve user information

Add a user

Add a teamUpdate a user profile

Add users to a team

Delete a user

Delete a team© 2021 Keeper Security, Inc.

DATASHEET

Automated Provisioning

SAML (Security Assertion Markup Language)

Exemplary Integrations with Keeper Enterprise*

Keeper supports SAML 2.0 for provisioning and authenticating
users with our proprietary Keeper® SSO Connect software. Keeper
SSO Connect is a SAML 2.0 application which leverages Keeper’s
zero-knowledge security architecture to securely and seamlessly
authenticate users into their Keeper Vault and dynamicallyprovision users to the platform.

•On-prem Active Directory sync using the Keeper AD Bridgesoftware•Microsoft Azure AD integration with SAML 2.0 and SCIM•G Suite integration through SAML 2.0 and Auto Provisioning
through SCIM•

Okta integration through SAML 2.0 and Auto Provisioning
through SCIM•

Email-based Provisioning through self service and emailverification•API Provisioning using the Keeper Commander CLI and SDKplatform•

Any SAML 2.0 compliant identity provider•

Any SCIM 2.0 compliant directory service or identity provider

Keeper SSO Connect supports the following features:•Seamless authentication with any SAML 2.0 compliant identityprovider•

Just-in-time (JIT) provisioning of users•

Access on any platform including desktop, mobile and tablet
devices•Segmentation of SAML-based users and non-SAML user

*Additional integrations are available based on the customer’s
provisioning environment.

System Architecture

On-Prem Directory

Cloud Directory
SCIM

LDAP

Custom Software

Keeper Backend

API

Keeper SSO Connect
SAML

End-User Vaults

keepersecurity.com | sales@keepersecurity.com© 2021 Keeper Security, Inc.