Quickstart: Admin Console

This guide walks an IT administrator or identity team through creating a QuantPass organization, configuring Single Sign-On (SSO) with Okta or Microsoft Entra ID, and enabling SCIM 2.0 automated user provisioning. This is the fastest path to a pilot deployment.

Prerequisites

  • An admin account on QuantPass. Contact sales@quantcert.ai to provision your organization.
  • Admin access to your Identity Provider — Okta, Microsoft Entra ID (Azure AD), or Google Workspace.
  • Approximately 15 minutes.

Step 1 — Access the Admin Console

  • Navigate to app.quantcert.ai and sign in with your admin account.
  • On first login you will be prompted to complete organization setup. Enter your organization name and primary domain (e.g. yourcompany.com).
  • You will land on the Home dashboard, which shows your PQC Migration Status, active member count, and vault health score.

Step 2 — Configure SSO

QuantPass supports SSO via SAML 2.0 and OIDC, federated through AWS Cognito. Follow the steps for your Identity Provider:

Okta

  • In the Admin Console, go to Integrations → Identity Providers and click the Okta card.
  • Copy the ACS URL and Entity ID shown in the modal.
  • In Okta, go to Applications → Create App Integration → SAML 2.0 and paste the ACS URL and Entity ID into the corresponding fields.
  • Under Attribute Statements, map email to user.email and firstName / lastName to the respective Okta profile fields.
  • Download the Okta metadata XML and upload it back in the QuantPass Integrations modal, then click Save.
  • Test the connection by clicking Test SSO. A green checkmark confirms the handshake is working.

Microsoft Entra ID (Azure AD)

  • In the Admin Console, go to Integrations → Identity Providers and click the Entra ID card.
  • Copy the Reply URL (ACS URL) and Identifier (Entity ID).
  • In the Azure Portal, go to Enterprise Applications → New Application → Create your own application.
  • Select Integrate any other application you don't find in the gallery, then go to Single sign-on → SAML.
  • Paste the Reply URL and Identifier into the Basic SAML Configuration section.
  • Download the Federation Metadata XML from Azure and upload it in the QuantPass Integrations modal, then click Save.

Step 3 — Enable SCIM 2.0 Provisioning

SCIM allows your Identity Provider to automatically create, update, and deactivate QuantPass accounts when employees join, move roles, or leave your organization. QuantPass uses a fully serverless SCIM 2.0 server — no on-premise agent or bridge is required.
  • In the Admin Console, go to Integrations → Provisioning.
  • Click Generate SCIM Token. Copy the bearer token — you will not be able to view it again.
  • Copy the SCIM Base URL shown on the page (format: https://api.quantcert.ai/scim/v2).

Configure SCIM in Okta

  • In your Okta application, go to the Provisioning tab and click Configure API Integration.
  • Check Enable API integration and paste the SCIM Base URL into the Base URL field.
  • Paste the bearer token into the API Token field and click Test API Credentials.
  • Enable Create Users, Update User Attributes, and Deactivate Users, then click Save.

Configure SCIM in Microsoft Entra ID

  • In your Azure Enterprise Application, go to Provisioning and set Provisioning Mode to Automatic.
  • Paste the SCIM Base URL into the Tenant URL field and the bearer token into the Secret Token field.
  • Click Test Connection, then set Provisioning Status to On and click Save.
Zero-latency deprovisioning: When an employee is deactivated in your IdP, QuantPass executes a Global Sign-Out via AWS Cognito within milliseconds — invalidating all JWT tokens across the mobile app, web console, and browser extension simultaneously.

Step 4 — Invite Your First Users

If you want to invite users manually before SCIM sync is active:
  • In the Admin Console, go to Directory → People and click Add User.
  • Enter the user's email address and select their role (Member or Admin).
  • Click Send Invite. The user will receive an email with a link to set up their QuantPass account.

What's Next?

  • Configure vault policies — go to Policies to set master password complexity requirements and PQC cryptographic floor rules.
  • Set up the Events API — connect QuantPass audit logs to your SIEM (Splunk, Microsoft Sentinel) by going to Integrations → SIEM.
  • Enable Q-PAM — configure just-in-time privileged access for your admin team under Integrations → Q-PAM.
  • View the audit log — go to Event Logs to see real-time authentication events with cryptographic agility context (e.g. "User authenticated via Dilithium-Level-3").