Security and Control

​

Single Sign-On (SSO)

​

Enable SSO

1. Go to Admin Console > Security > Single Sign-On.
2. Turn on the Enable SSO toggle.
3. Select a sign-on protocol.
4. Select your identity provider and enter the configuration details.
5. Click Save.

​

SAML

​

Okta

1. Log in to the Okta Admin Dashboard.
2. Go to Applications > Add Application > Create Application.
3. Enter an App Name and click Next.
4. Under Configure SAML, paste the ACS URL for SP-Initiated SAML Flow from the platform into the Okta Single Sign-On URL field.
   • For on-premise accounts, use https://idproxy-dev.<platform>.com/authorize/callback as the SSO URL and https://idproxy-dev.<platform>.com as the Audience URL.
5. Click Finish.
6. On the Sign On tab, click View Setup Instructions and copy:
   • Identity Provider Single Sign-On URL → Okta Single Sign-On URL on the platform
   • Identity Provider Issuer → Identity Provider Issuer on the platform
   • X.509 Certificate → Certificate on the platform
7. Click Save.

​

OneLogin

1. In the OneLogin Portal, go to Applications > Add Apps, search for your app, and save it.
2. On the SSO tab, copy:
   • OneLogin SAML 2.0 Endpoint (HTTP) → SAML 2.0 Endpoint on the platform
   • OneLogin Issuer URL → Issuer URL on the platform
3. Click View Details on the X.509 Certificate field. Copy the certificate data (between the header and footer lines) and paste it into the X.509 Certificate field on the platform.
4. Copy the ACS URL for SP-Initiated SAML Flow and ACS URL for IDP-Initiated SAML Flow from the platform and paste them into the corresponding fields in OneLogin.
5. Click Save in both the platform and OneLogin.

​

Bitium

1. In Bitium, go to Manage Organization > Manage Apps > App.
2. On the Single Sign-On tab, select SAML Authentication.
3. Copy:
   • Bitium Login URL → Single Sign-On URL on the platform
   • Bitium Logout URL → Issuer URL on the platform
   • X.509 Certificate → Certificate on the platform
4. Click Save.

​

Other SAML Providers

​

WS-Federation

​

Windows Azure

1. Log in to the Azure Portal and go to Microsoft Entra ID > Enterprise Applications > New Application > Create your own application.
2. Enter the application name and click Create.
3. Go to Single sign-on and select WS-Fed.
4. Configure the Identifier (Entity ID) and Reply URL provided by the platform.
5. Go to Users and Groups and assign users or groups.
6. Go to App Registrations > Endpoints and copy:
   • WS-Federation Sign-On Endpoint → Azure AD Sign-On Endpoint URL on the platform
   • Federation Metadata Document URL → Azure AD Federation Metadata Document on the platform
7. Click Save.

​

Other WS-Federation Providers (ADFS)

1. Open ADFS Management on your ADFS server. Right-click Relying Party Trusts and select Add Relying Party Trust.
2. Choose Enter data about the relying party manually and click Next.
3. Select AD FS profile and skip certificate configuration.
4. Enable WS-Federation Passive protocol and enter the Relying Party WS-Federation Passive protocol URL provided by the platform.
5. Enter the relying party trust identifier provided by the platform.
6. In Edit Claim Rules, click Add Rule, select Send LDAP Attributes as Claims, and map:
   • E-Mail-Addresses → E-Mail Address
   • Given-Name → Given Name
   • Surname → Surname
   • User-Principal-Name → UPN
7. Add another rule: select Transform an Incoming Claim, set Incoming claim type to E-Mail Address, Outgoing claim type to Name ID, and Outgoing name ID format to Email.
8. In Service > Endpoints, copy:
   • WS-Federation Passive Endpoint (/adfs/ls/) → AD Sign-On Endpoint URL on the platform
   • Federation Metadata URL → AD Federation Metadata Document URL on the platform
9. Click Save.

​

OpenID Connect (OIDC)

​

Google

1. Log in to Google Cloud Console.
2. Go to IAM & Admin > Service Accounts > Create Service Account. Enter a name, click Create and Continue, then Done.
3. Click the service account → Keys > Add Key > Create New Key → select JSON → Create. Save the downloaded file securely.
4. In the service account details, enable Google Workspace Domain-wide Delegation and note the Client ID.
5. Log in to Google Admin Console.
6. Go to Security > API Controls > Domain-wide Delegation > Add new.
7. Enter the Client ID and add the following OAuth scopes as a comma-separated list:
   • https://www.googleapis.com/auth/admin.directory.user.readonly
   • https://www.googleapis.com/auth/admin.directory.group.readonly
   • https://www.googleapis.com/auth/admin.directory.orgunit.readonly
   • https://www.googleapis.com/auth/admin.directory.domain.readonly
8. Click Authorize.
9. In the platform, select Sign in with Google, enable Configure service account for your G-Suite domain, and enter the values from the JSON key file:
   • client_email → Client Email
   • private_key → Private Key
   • Admin email → Admin Email
10. Click Save.

​

Microsoft Azure

1. Log in to the Azure Portal and go to Microsoft Entra ID > App Registrations > New Registration.
2. Enter an application name and add the Redirect URL from the platform as the redirect URI. Click Register.
3. Under Authentication, enable ID Tokens under Implicit grant and hybrid flows.
4. Under Certificates & Secrets, create a new client secret. Copy the Value immediately — it is shown only once.
5. Under API Permissions, add Microsoft Graph delegated permissions: User.Read, email, openid, profile. Click Grant Admin Consent.
6. From the app Overview page, copy the Application (client) ID and Directory (tenant) ID.
7. In the platform, select Microsoft Azure, enter the credentials, and click Save.

​

Service Accounts

​

Add a Service Account

​

Google

​

Microsoft Azure

1. Log in to the Azure Portal and search for App Registrations.
2. Click New Registration, enter an application name, select the tenant type (Single or Multi-tenant), and click Register.
3. Go to API Permissions > Add a Permission > Microsoft Graph > Application Permissions and add the required permissions above.
4. Click Grant Admin Consent for [Your Organization].
5. Go to Certificates & Secrets > New Client Secret. Select an expiration period and click Add. Copy the Value immediately.
6. From the app Overview, copy the Application (client) ID and Directory (tenant) ID.

​

LDAP

​

Manage Service Accounts

​

Enterprise Encryption

​

Default Key

• Copy — Copy the current key to your clipboard.
• Refresh — Generate a new default key.

​

Bring Your Own Key (BYOK)

​

Configure BYOK

1. Go to Admin Console > Enterprise Encryption.
2. Under Bring Your Own Key, click Create Key.
3. Select your cloud provider (AWS or Azure).
4. Note the pre-populated values shown by the platform — these are required when configuring your cloud provider.
5. Enter the required identifiers (see provider sections below).
6. Click Test Connection to validate key access and permissions.
7. Click Next, then Proceed to activate.

​

AWS KMS

1. In the AWS KMS console, note your CMK ARN from the key’s details page.
2. In IAM > Roles > Create Role, select Another AWS account, enter the Service Role ARN provided by the platform, and name the role.
3. Set the trust policy on the role (replace placeholders with actual values):
   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Principal": { "AWS": "<Service-Role-ARN>" },
       "Action": "sts:AssumeRole",
       "Condition": { "StringEquals": { "sts:ExternalId": "<External-ID>" } }
     }]
   }
   
4. Create and attach a permissions policy to the role:
   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Action": ["kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey"],
       "Resource": "<your-cmk-arn>"
     }]
   }
   
5. In the KMS console, add the IAM role to the CMK’s key policy:
   {
     "Effect": "Allow",
     "Principal": { "AWS": "<your-role-arn>" },
     "Action": ["kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey"],
     "Resource": "*"
   }
   
6. Contact Kore.ai support and share your CMK ARN and Role ARN to complete the integration.

​

Azure Key Vault

1. Sign in to the Azure portal as a Global Administrator and grant admin consent for the platform’s application using one of:
   • Admin Consent URL: Navigate to https://login.microsoftonline.com/<your-tenant-id>/adminconsent?client_id=<platform-client-id>
   • Azure CLI: Run az ad sp create --id '<platform-client-id>'
2. In your Key Vault, go to Access Control (IAM) > Add Role Assignment and assign the platform’s service principal:
   • Key Vault Crypto User — for cryptographic operations (wrap/unwrap keys)
   • Key Vault Reader — for reading Key Vault metadata
3. Share the following with Kore.ai support: Tenant ID, Key Vault URI, and Key Name.
4. After the team configures the connection, go to Key Vault > Networking > Private Endpoint Connections and approve the pending request.

​

Data Settings

​

Conversation Data Storage

​

Data Retention Period

​

Domain Management

​

Domain Types

​

Add a Domain

1. Click Add New.
2. Select the domain type (Company or Partner).
3. Enter the domain details and submit for verification.
4. Verified domains are added to the account. Rejected domains remain listed with a Rejected status.

​

Access Rules

​

Switching Accounts (Partner Users)

​

Personal API Key

​

Manage Your Key

​

Authenticate API Requests

--header 'auth: {{Admin's Personalkey}}'