> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The sign-in experience

> What signing in to Iru looks like for end users, whether directly with a passkey or through a connected identity provider, and the app dashboard they land on.

Whether someone signs in directly with Iru or through a provider you already run, they
end up in the same place: an app dashboard of the applications they are
allowed to use.

## How users sign in

By default, **Iru Identity is your identity provider**: users sign in to
Iru directly, and Iru signs them in to their apps. You can also let them sign in
through a provider you already run, in specific situations. Both paths lead to
the same app dashboard.

<CardGroup cols={2}>
  <Card title="Directly with Iru (default)" icon="key">
    The user proves who they are to Iru itself, typically with a **passkey** (a
    quick fingerprint, face, or screen-lock gesture) or the **Iru Access**
    app. No password required. This is how most users sign in.
  </Card>

  <Card title="Through a provider you already run" icon="building-lock">
    The user signs in with an existing provider, such as Google Workspace or
    Microsoft Entra ID, and Iru continues once the provider confirms them. This
    **federated** sign-in is for when you use Iru as an authentication layer into
    the Iru platform, or to ease a migration onto Iru Identity.
  </Card>
</CardGroup>

```mermaid theme={null}
flowchart TD
  start["User starts sign-in"] --> choice{"How is sign-in<br/>set up?"}
  choice -->|"Direct (default)"| direct["Prove identity to Iru<br/>with a passkey or Iru Access"]
  choice -->|"Federated (optional)"| fed["Sign in with a<br/>provider you already run"]
  direct --> policy["Iru evaluates the<br/>authentication policy"]
  fed --> policy
  policy -->|"Allowed"| dash["App dashboard"]
  policy -->|"Denied"| stop["Access denied,<br/>with the reason"]
```

The user always proves who they are with their authenticator (a passkey or Iru
Access). Iru then evaluates the relevant
[authentication policy](/en/identity/authentication/authentication-policies)
before granting access. A policy can require a trusted device, so the exact
prompts a user sees can depend on the app they are reaching and the rules you
have set.

<Note>
  Federated sign-in is configured through an identity provider connection. To set
  one up, see
  [Federated Authentication](/en/identity/connections/connections-overview).
</Note>

## The app dashboard

Once signed in, each user lands on their own app dashboard. It greets them by name
and shows the applications your organization has assigned to them.

<CardGroup cols={2}>
  <Card title="Your Applications" icon="grip">
    Every application the user has access to appears as a tile. Selecting a
    tile signs them straight in to that app, with no separate password for the app
    itself.
  </Card>

  <Card title="Favorites" icon="star">
    Users can star the apps they use most so they surface at the top of their
    app dashboard for quick access.
  </Card>
</CardGroup>

The app dashboard only ever shows the apps a user is actually assigned, so what
each user sees reflects the access you have granted them. To control who sees
which apps, see [Assigning access](/en/identity/applications/assigning-access).

<Tip>
  Selecting an app tile starts a single sign-on into that app. If an app's policy
  requires something the user has not satisfied yet (such as enrolling a
  passkey), they are prompted at that point.
</Tip>

<Note>
  For what end users see when they sign in and open apps, see
  [Accessing your apps](/en/identity/end-user/accessing-your-apps). For passkey
  and Iru Access setup, see [Manage authenticators](/en/identity/end-user/manage-authenticators).
  On macOS, if a passkey does not appear in the browser prompt, see the tip in
  [Accessing your apps](/en/identity/end-user/accessing-your-apps#find-and-open-an-app).
</Note>

## Where to go next

<CardGroup cols={2}>
  <Card title="End-user experience" icon="user" href="/en/identity/administration/end-user-experience">
    A fuller tour of what end users see and manage in Iru, including their
    authenticators.
  </Card>

  <Card title="Federated Authentication" icon="plug" href="/en/identity/connections/connections-overview">
    Let users sign in through Google Workspace, Microsoft Entra ID, or another
    provider you already run.
  </Card>

  <Card title="Authenticators" icon="key" href="/en/identity/authentication/authenticators">
    The passkeys and credentials users use to prove who they are.
  </Card>

  <Card title="Authentication policies" icon="shield-halved" href="/en/identity/authentication/authentication-policies">
    What Iru checks between sign-in and access.
  </Card>

  <Card title="Accessing your apps" icon="house" href="/en/identity/end-user/accessing-your-apps">
    What end users see when they sign in and open apps from the app dashboard
  </Card>

  <Card title="Manage authenticators" icon="id-badge" href="/en/identity/end-user/manage-authenticators">
    End-user guide for passkeys, Iru Access, and backup devices
  </Card>
</CardGroup>