---
title: Cookbook for Ivanti Neurons
slug: access-guide/cookbook-for-ivanti-neurons
docTags: 
createdAt: 2026-10-09T06:41:06.127Z
---

## Integrating Ivanti Neurons as a SAML Service Provider with Ivanti Access

Ivanti Neurons can work as SAML service provider. Use Okta or any appropriate IDP and configure a Customer SP federation pair on Ivanti Access using the dedicated Ivanti Neurons SP catalog item and your chosen IDP.

This cookbook considers Okta as the identity provider.

:::hint{type="info"}
**Custom Rules**: You can apply custom conditional access policies to this federation. For example, you can configure Network Rules in Ivanti Access to restrict user logins for Ivanti Neurons to a specific IP range.
:::

**Prerequisites**

- Ensure your global SAML configuration is correct.
- Ensure you have the required administrative privileges in Ivanti Neurons, Ivanti Access, and Okta.
- For configuring an external authenticator provider in Neurons, see [External Authentication (SSO)](https://help.ivanti.com/ht/help/en_US/CLOUD/vNow/external-authentication-SSO.htm).

### Phase 1: Preparing Metadata

### Creating the Identity Provider metadata record in Ivanti Neurons

**Procedure**

1. Log in to the Ivanti Neurons admin portal.
2. Navigate to the SSO/SAML configuration section.
3. Select **Other IdP** to create a new external authentication provider.
4. Select **Enabled Signed Requests** and then click **Apply Changes**.
5. Select **Download SP metadata**.
6. Upload the Access IdP metadata. For further details, refer Phase 2 and Phase 3.
7. Click **Continue**.

:::hint{type="info"}
Encrypted assertions are not supported in Ivanti Access.
:::

### Phase 2: Configuring the Federated Pair on Ivanti Access

### Setting up the Federation Pair

**Procedure**

1. Log in to the Ivanti Access admin portal.
2. Navigate to **Profile** > **Federation** > **Add Pair**.
3. From the service provider catalog, select the dedicated **Ivanti Neurons** tile.

:::hint{type="info" indent="1"}
Do not use the 'Custom SAML' option; selecting the Neurons tile ensures proper analytics tracking.
:::

4. Upload the Ivanti Neurons 'SAML metadata.xml' that you downloaded in the previous phase.
5. Click **Next**.
6. Select **Okta** as the identity provider from the catalog.
7. Upload the Okta Metadata.
8. Click **Done**.

### Phase 3: Finalizing the Integration

### Updating Ivanti Neurons to federate with Ivanti Access

**Procedure**

1. Log in to the Ivanti Neurons admin portal.
2. Edit the metadata provider you created earlier.
3. Update the configuration to point to the **Access IDP Metadata (Upload to SP)** option.
4. Ensure that the Identity Provider Entity ID is updated to the newly generated Access URL.

### Updating Okta configuration

**Procedure**

1. Log in to the Okta admin portal.
2. Edit the application configuration for this setup to recognize the Ivanti Access integration as the trusted entity routing the authentication.
3. While configuring Okta Console, as listed in [Okta Authentication (SAML)](https://help.ivanti.com/ht/help/en_US/CLOUD/vNow/auth-okta-SAML.htm), ensure to update the attributes in **Configure SAML **> **Attribute Statements**, as follows:
   1. (Mandatory) **Name**: 'email', **Value**: 'user.email'. Click **Add Another**.
   2. (Optional) **Name**: 'given\_name', **Value**: 'user.firstName'. Click **Add Another**.
   3. (Optional) **Name**: 'family\_name', **Value**: 'user.lastName'.

      :::hint{type="info"}
      The data in the above fields is case-sensitive.
      :::

### Publish the Profile

Once all configurations and rules are set, publish the profile in Ivanti Access to apply the changes.

- Return to the Ivanti Neurons admin portal. Click **Continue** > **Validate Settings**. The validation takes place automatically. You will receive a confirmation screen if login is successful.

### (Optional) Configuring Conditional Network Rules

**Procedure**

1. In the Ivanti Access admin portal, open your newly created Ivanti Neurons federation pair.
2. Navigate to the **Custom Rules** option.
3. Select **Network Rule**.
4. Define the permitted IP range to restrict login access to those specific IPs.
5. Click **Save**.