)
- }
+}
\ No newline at end of file
diff --git a/src/pages/how-to/huntress-edr.mdx b/src/pages/how-to/huntress-edr.mdx
new file mode 100644
index 00000000..1e3ee8fc
--- /dev/null
+++ b/src/pages/how-to/huntress-edr.mdx
@@ -0,0 +1,98 @@
+# Restrict Network Access with Huntress EDR
+
+[Huntress](https://www.huntress.com/) is a managed detection and response (MDR) platform designed for IT service providers and enterprises to protect endpoints from cyber threats. The Huntress agent continuously monitors endpoints, collecting security telemetry including Windows Defender status, firewall configuration, and policy compliance, which can be used to enforce network access controls based on device security posture.
+
+The integration of NetBird with Huntress provides network security by ensuring only devices that meet your defined security standards can access the protected network. This approach allows administrators to enforce access restrictions based on critical Windows security settings such as Defender health status, antivirus definitions, firewall state, and policy compliance, ensuring only properly secured endpoints have access to network resources via NetBird.
+
+In this guide, you'll learn how to integrate NetBird with Huntress and configure access controls to allow only compliant devices onto your network.
+
+
+ TLDR: Devices that fail to meet Huntress security requirements (Windows Defender health, firewall status, or policy compliance) will automatically lose network access. Once a device meets all compliance criteria, access is restored.
+
+
+
+## Prerequisites
+
+Before you start creating and configuring a Huntress integration, ensure that you have the following:
+- A Huntress account with the permissions to create and manage API keys.
+ If you don't have the required permissions, ask your Huntress administrator to grant them to you.
+
+## Create a Huntress API Key
+
+- Navigate to your Huntress Management Console
+- Go to **Settings** » **API Credentials**
+- Click **Create API Credential**
+- Fill in the form:
+ - **Name**: `NetBird Integration`
+ - **Description**: `API key for NetBird EDR integration` (optional)
+- Click **Create**
+- Copy the generated API key and secret immediately (they will only be displayed once)
+- Note your Huntress organization key from the console
+
+
+Treat the API credentials securely and store them safely. You will need both the API key and secret for the NetBird integration configuration.
+
+
+## Configure a Huntress Integration in NetBird
+
+- Navigate to the [Integrations » EDR](https://app.netbird.io/integrations?tab=edr) tab in the NetBird dashboard
+- Click **Connect Huntress** to start the configuration wizard
+
+
+
+- Click the **Get Started** button to initiate the integration process
+- Enter your Huntress organization key and click **Continue**
+
+
+
+
+
+- Enter the API key and secret you created in the previous step and click **Continue** to verify the connection
+
+
+
+
+
+- Select the **groups** you want to apply the integration to and click **Connect**
+
+
+
+
+
+
+
+ The EDR check will apply only to peers in the selected groups and will require a running Huntress agent.
+ You can also use groups [synchronized from your Identity Provider (IdP)](/how-to/idp-sync).
+
+
+- Configure the compliance criteria that devices must meet to access your network. These security requirements ensure only healthy, properly configured devices can connect. Select the criteria that align with your organization's security policies:
+ - **Defender Policy Status**: Requires Windows Defender policy status to be compliant. Default is set to `Compliant`.
+ - **Defender Status**: Requires Windows Defender to be in a healthy state. Default is set to `Healthy`.
+ - **Defender Substatus**: Requires Windows Defender to be up to date with the latest definitions. Default is set to `Up to date`.
+ - **Firewall Status**: Requires the device firewall to be enabled. Can be set to check if firewall is `Enabled` or `Disabled`. Default is to require `Enabled`.
+
+
+
+
+
+
+- Configure the **Huntress Sync Window** (default is 24 hours). This setting determines which devices NetBird will consider for network access based on their recent activity in Huntress. Only devices that have been active and reporting to Huntress within this time window will be synchronized. These devices must then also meet the configured compliance criteria to gain network access.
+
+
+
+
+
+- Click **Connect** to complete the integration setup
+
+- Only peers that have the Huntress agent installed and meet all the configured compliance criteria will be granted access to the network.
+ Peers without the Huntress agent or those that don't meet the compliance requirements will appear with an `Approval required` mark in the peers list and won't be able to access
+ the network until they have the agent installed and satisfy all the specified security requirements.
+
+
+
+
+
+
+
+ NetBird matches the Huntress agent to the peer using the Serial Number of the device. You must ensure that each of your devices has a unique serial number.
+
\ No newline at end of file
diff --git a/src/pages/manage/access-control/endpoint-detection-and-response/huntress-edr.mdx b/src/pages/manage/access-control/endpoint-detection-and-response/huntress-edr.mdx
new file mode 100644
index 00000000..cf0f3a0b
--- /dev/null
+++ b/src/pages/manage/access-control/endpoint-detection-and-response/huntress-edr.mdx
@@ -0,0 +1,91 @@
+# Restrict Network Access with Huntress EDR
+
+[Huntress](https://www.huntress.com/) is a managed detection and response (MDR) platform designed for IT service providers and enterprises to protect endpoints from cyber threats. The Huntress agent continuously monitors endpoints, collecting security telemetry including Windows Defender status, firewall configuration, and policy compliance, which can be used to enforce network access controls based on device security posture.
+
+The integration of NetBird with Huntress provides network security by ensuring only devices that meet your defined security standards can access the protected network. This approach allows administrators to enforce access restrictions based on critical Windows security settings such as Defender health status, antivirus definitions, firewall state, and policy compliance, ensuring only properly secured endpoints have access to network resources via NetBird.
+
+In this guide, you'll learn how to integrate NetBird with Huntress and configure access controls to allow only compliant devices onto your network.
+
+
+ TLDR: Devices that fail to meet Huntress security requirements (Defender Policy Status, Managed Microsoft Defender, or Firewall) will automatically lose network access. Once a device meets all compliance criteria, access is restored.
+
+
+
+## Prerequisites
+
+Before you start creating and configuring a Huntress integration, ensure that you have the following:
+- A Huntress account with the permissions to create and manage API keys.
+ If you don't have the required permissions, ask your Huntress administrator to grant them to you.
+
+## Create a Huntress API Key
+
+- Navigate to your Huntress Management Console
+- Go to **Settings** » **API Credentials**
+- Click **Create API Credential**
+- Fill in the form:
+ - **Name**: `NetBird Integration`
+ - **Description**: `API key for NetBird EDR integration` (optional)
+- Click **Create**
+- Copy the generated API key and secret immediately (they will only be displayed once)
+- Note your Huntress organization key from the console
+
+
+Treat the API credentials securely and store them safely. You will need both the API key and secret for the NetBird integration configuration.
+
+
+## Configure a Huntress Integration in NetBird
+
+- Navigate to the [Integrations » EDR](https://app.netbird.io/integrations?tab=edr) tab in the NetBird dashboard
+- Click **Connect Huntress** to start the configuration wizard
+
+
+
+- Click the **Get Started** button to initiate the integration process
+- Enter the API key and secret you created in the previous step and click **Continue** to verify the connection
+
+
+
+
+
+- Select the **groups** you want to apply the integration to and click **Connect**
+
+
+
+
+
+
+
+ The EDR check will apply only to peers in the selected groups and will require a running Huntress agent.
+ You can also use groups [synchronized from your Identity Provider (IdP)](/how-to/idp-sync).
+
+
+- Configure the compliance criteria that devices must meet to access your network. These security requirements ensure only healthy, properly configured devices can connect. Select the criteria that align with your organization's security policies:
+ - **Defender Policy Status**: Requires Windows Defender configuration to match your organization's security policy requirements.
+ - **Managed Microsoft Defender**: Requires Defender to be enabled, up-to-date, scanned recently, and no conflicting antivirus detected.
+ - **Firewall**: Requires an active firewall with all required profiles enabled.
+
+
+
+
+
+
+- Configure the **Huntress Sync Window** (default is 24 hours). This setting determines which devices NetBird will consider for network access based on their recent activity in Huntress. Only devices that have been active and reporting to Huntress within this time window will be synchronized. These devices must then also meet the configured compliance criteria to gain network access.
+
+
+
+
+
+- Click **Connect** to complete the integration setup
+
+- Only peers that have the Huntress agent installed and meet all the configured compliance criteria will be granted access to the network.
+ Peers without the Huntress agent or those that don't meet the compliance requirements will appear with an `Approval required` mark in the peers list and won't be able to access
+ the network until they have the agent installed and satisfy all the specified security requirements.
+
+
+
+
+
+
+
+ NetBird matches the Huntress agent to the peer using the Serial Number of the device. You must ensure that each of your devices has a unique serial number.
+
\ No newline at end of file
diff --git a/src/pages/manage/team/idp-sync/okta-sync.mdx b/src/pages/manage/team/idp-sync/okta-sync.mdx
index 0cfcc37c..414e50eb 100644
--- a/src/pages/manage/team/idp-sync/okta-sync.mdx
+++ b/src/pages/manage/team/idp-sync/okta-sync.mdx
@@ -2,7 +2,7 @@ import {
Note
} from "@/components/mdx";
-# Provision Users and Groups From Okta
+# Provision Users and Groups from Okta
Okta is a cloud-based identity and access management (IAM) platform that centralizes user and customer profiles to enhance
security and streamline access. It offers features like multifactor authentication, single sign-on, and lifecycle
diff --git a/src/pages/manage/team/single-sign-on.mdx b/src/pages/manage/team/single-sign-on.mdx
deleted file mode 100644
index c7ef95dd..00000000
--- a/src/pages/manage/team/single-sign-on.mdx
+++ /dev/null
@@ -1,249 +0,0 @@
-import {Note} from "@/components/mdx";
-
-# Authenticate to NetBird with Single Sign On (SSO)
-
-NetBird works out of the box with popular Identity Providers (IdPs) such as Google Workspace, Microsoft Entra ID, and Okta,
-offering seamless Single Sign-On (SSO) for your users.
-
-It also supports social logins including Google, GitHub, and Microsoft accounts.
-
-For other OIDC (OpenID Connect)-compliant IdPs like Authentik, Keycloak, JumpCloud, and others, NetBird provides full support,
-though some additional configuration is required to complete the integration.
-
-
- This guide covers the setup for cloud-hosted NetBird. If you are using the self-hosted version, please refer
- to the [self-hosted documentation](/selfhosted/identity-providers).
-
-
-## Google, Microsoft, and GitHub
-
-If you're using Google Workspace, Microsoft Entra ID, or a supported social login, you can simply sign in with no extra
-setup—just click the appropriate button on the [login page](https://app.netbird.io/):
-
-
-
-
-
-## Okta
-
-If you are using Okta as your Identity Provider, sign up with any email address and then follow the steps described
-in [this guide](/manage/team/idp-sync/okta-sync#get-started-with-net-bird-okta-integration)
-
-## OIDC-compliant IdPs
-
-For OIDC-compliant Identity Providers such as **Authentik**, **Keycloak**, and others, you’ll need to configure the IdP
-to integrate with NetBird. Below are the steps to set up different OIDC-compliant IdPs with NetBird.
-
-
- Support for OIDC-compliant IdPs is available on the Team plan and higher.
- The Free plan supports Google, Microsoft, and social logins.
-
-
-### Authentik
-
-1. You need to create a new Application and Provider.
- - Browse to the Applications Administration menu, click on Application, and then click on Create with Provider:
-
-
-
-
- - Name the Application and select a suitable explicit user flow. In the example below, we used NetBird:
-
-
-
-
-
- - Click Next and select the OAuth2/OpenID Provider Type:
-
-
-
-
-
- - Click Next and select an explicit user authorization flow, then take note of the Client ID and Client Secret:
-
-
-
-
- - Add the following redirect URL and select a signing key:
- URL: `https://login.netbird.io/login/callback`
-
-
-
-
- - Click on Advanced protocol settings and ensure that the email, opened, and profile scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
-
-
-
-
-
- - Click Next on the following two screens and Submit to create the provider and application:
-
-
-
-
-
- - You should see an application listed as follow:
-
-
-
-
-
-2. We need to copy the OpenID Configuration URL for the new provider. You can do that by navigating to Providers in the left menu and then selecting the newly created provider. There you should see a windows similar to the following:
-
-
-
-
-
- - Copy the OpenID Configuration URL.
-
-
-3. Then, share the following information with the NetBird support team at support@netbird.io:
-
-- Client ID
-- Client Secret
-- OpenID Configuration URL
-- Email domains for your users
-
-
-We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like:
-https://onetimesecret.com/en/
-https://password.link/en
-
-
-### Keycloak
-
-1. You need to create a new client
-
- - Browse to the clients Administration menu and then click in Create client:
-
-
-
-
-
-2. Create a client with the type OpenID Connect and add any client ID and name for the client:
-
-
-
-
-
-3. Click Next and enable the following options for Capability config:
-
-
-
-
-
-4. Click Next and fill the following fields:
-
- Valid redirect URIs: `https://login.netbird.io/login/callback`
- Web origins: `+`
-
-
-
-
-
-5. Click Save.
-
-6. Next we need to retrieve the secret for the client, you can get that in the Credentials tab for the client:
-
-
-
-
-
-7. Then, share the following information with the NetBird support team at support@netbird.io:
-
-- Client ID
-- Keycloak URL
-- Realm
-- Client Secret
-- Email domains for your users
-
-
-We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like:
-https://onetimesecret.com/en/
-https://password.link/en
-
-
-### JumpCloud
-
-1. Access the JumpCloud and navigate to USER AUTHENTICATION > SSO Applications
-
-2. Click + Add New Application, select Custom Application and click Next
-
-3. Enable Manage Single Sign-On (SSO), select Configure SSO with OIDC and click Next
-
-
-
-
-
-4. Add NetBird as Display Label and click Next. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
-
-5. Review the application setting and click Configure Application to proceed
-
-
-
-
-
-6. On the New Application screen, go to the SSO tab and under Endpoint Configuration set the following values:
-
-- Redirect URIs: https://login.netbird.io/login/callback
-
-- Login URL: https://app.netbird.io
-
-7. Under Attribute Mapping enable Email and Profile scopes
-
-
- Sometimes, the Jumpcloud application configuration will add duplicate attributes, like email and email_verified. The duplicates should be removed.
-
-
-8. Go to the User Groups and select the list of groups to which you want to give access to the application and then click activate
-
-9. Record the Client ID and Client Secret that JumpCloud generates for your application.
-
-10. Share your Client ID, and Client Secret with our team. Please use a secure method for sharing this information.
-
-
-We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like:
-- https://onetimesecret.com/en/
-- https://password.link/en
-
-
-### Auth0
-
-1. Access the [Auth0 console](https://manage.auth0.com/) and navigate to Applications > Applications
-
-2. Click **+ Create Application**
-
-3. Enter **NetBird** as the name, select **Single Page Web Applications** as the application type and click **Create**
-
-
-
-
-
-4. On the New Application screen, go to the Settings tab and under Application URIs set the following values:
-- Application Login URI: https://app.netbird.io
-- Allowed Callback URLs: https://login.netbird.io/login/callback
-- Allowed Logout URLs: https://app.netbird.io
-- Allowed Web Origins: https://app.netbird.io
-
-
-
-
-
-6. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
-
-7. Retrieve Application's **Domain** from the **Basic Information** tab
-
-
-
-
-
-8. Share following with our team. Please use a secure method for sharing the sensitive parts of this information:
- 1. Application's **Domain**,
- 2. (sensitive) **Client ID** and **Client Secret**,
- 3. list of email domains to be registered for this SSO configuration,
-
-
-We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like:
-- https://onetimesecret.com/en/
-- https://password.link/en
-
diff --git a/src/pages/manage/team/single-sign-on/auth0.mdx b/src/pages/manage/team/single-sign-on/auth0.mdx
new file mode 100644
index 00000000..fb7e315f
--- /dev/null
+++ b/src/pages/manage/team/single-sign-on/auth0.mdx
@@ -0,0 +1,44 @@
+import {Note} from "@/components/mdx";
+
+# Auth0 on NetBird Cloud
+
+You can use Auth0 as your Identity Provider with NetBird, but it will require some additional configuration steps. Auth0 is a flexible, drop-in solution to add authentication and authorization services to your applications. It's a managed service that offers extensive customization options, developer-friendly APIs, universal login, social identity providers, and advanced security features like anomaly detection and breached password detection.
+
+1. Access the [Auth0 console](https://manage.auth0.com/) and navigate to Applications > Applications
+
+2. Click **+ Create Application**
+
+3. Enter **NetBird** as the name, select **Single Page Web Applications** as the application type and click **Create**
+
+
+
+
+
+4. On the New Application screen, go to the Settings tab and under Application URIs set the following values:
+- Application Login URI: https://app.netbird.io
+- Allowed Callback URLs: https://login.netbird.io/login/callback
+- Allowed Logout URLs: https://app.netbird.io
+- Allowed Web Origins: https://app.netbird.io
+
+
+
+
+
+6. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
+
+7. Retrieve Application's **Domain** from the **Basic Information** tab
+
+
+
+
+
+8. Share following with our team. Please use a secure method for sharing the sensitive parts of this information:
+ 1. Application's **Domain**,
+ 2. (sensitive) **Client ID** and **Client Secret**,
+ 3. list of email domains to be registered for this SSO configuration,
+
+
+We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like:
+- https://onetimesecret.com/en/
+- https://password.link/en
+
diff --git a/src/pages/manage/team/single-sign-on/authentik.mdx b/src/pages/manage/team/single-sign-on/authentik.mdx
new file mode 100644
index 00000000..03209c03
--- /dev/null
+++ b/src/pages/manage/team/single-sign-on/authentik.mdx
@@ -0,0 +1,79 @@
+import {Note} from "@/components/mdx";
+
+# Authentik on NetBird Cloud
+
+You can use Authentik as your Identity Provider with NetBird, but it will require some additional configuration steps. Authentik is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols.
+
+
+ Support for OIDC-compliant IdPs is available on the Team plan and higher.
+ The Free plan supports Google, Microsoft, and social logins.
+
+
+1. You need to create a new Application and Provider.
+ - Browse to the Applications Administration menu, click on Application, and then click on Create with Provider:
+
+
+
+
+ - Name the Application and select a suitable explicit user flow. In the example below, we used NetBird:
+
+
+
+
+
+ - Click Next and select the OAuth2/OpenID Provider Type:
+
+
+
+
+
+ - Click Next and select an explicit user authorization flow, then take note of the Client ID and Client Secret:
+
+
+
+
+ - Add the following redirect URL and select a signing key:
+ URL: `https://login.netbird.io/login/callback`
+
+
+
+
+ - Click on Advanced protocol settings and ensure that the email, opened, and profile scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
+
+
+
+
+
+ - Click Next on the following two screens and Submit to create the provider and application:
+
+
+
+
+
+ - You should see an application listed as follow:
+
+
+
+
+
+2. We need to copy the OpenID Configuration URL for the new provider. You can do that by navigating to Providers in the left menu and then selecting the newly created provider. There you should see a windows similar to the following:
+
+
+
+
+
+ - Copy the OpenID Configuration URL.
+
+
+3. Then, share the following information with the NetBird support team at support@netbird.io:
+
+- Client ID
+- Client Secret
+- OpenID Configuration URL
+- Email domains for your users
+
+
+We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like:
+https://onetimesecret.com/en/
+https://password.link/en
+
diff --git a/src/pages/manage/team/single-sign-on/index.mdx b/src/pages/manage/team/single-sign-on/index.mdx
new file mode 100644
index 00000000..799cfb1d
--- /dev/null
+++ b/src/pages/manage/team/single-sign-on/index.mdx
@@ -0,0 +1,71 @@
+import { Note, Button } from '@/components/mdx'
+
+# Authenticate to NetBird with Single Sign On (SSO)
+
+NetBird works out of the box with popular Identity Providers (IdPs) such as Google Workspace, Microsoft Entra ID, and Okta,
+offering seamless Single Sign-On (SSO) for your users.
+
+It also supports social logins including Google, GitHub, and Microsoft accounts.
+
+For other OIDC (OpenID Connect)-compliant IdPs like Authentik, Keycloak, JumpCloud, and others, NetBird provides full support,
+though some additional configuration is required to complete the integration.
+
+
+ This guide covers the setup for cloud-hosted NetBird. If you are using the self-hosted version, please refer
+ to the [self-hosted documentation](/selfhosted/identity-providers).
+
+
+## Google, Microsoft, and GitHub
+
+If you're using Google Workspace, Microsoft Entra ID, or a supported social login, you can simply sign in with no extra
+setup—just click the appropriate button on the [login page](https://app.netbird.io/):
+
+
+
+
+
+## Okta
+
+[Okta](https://www.okta.com/) is a cloud-based identity and access management service designed for enterprise use. It provides single sign-on, multifactor authentication, user management, and lifecycle management capabilities. Okta offers extensive integration options with thousands of pre-built connectors, adaptive authentication, and comprehensive API access management.
+
+
+ The detailed setup steps for Okta integration, including SSO configuration and user/group provisioning, are available in our [Provision Users and Groups from Okta](/manage/team/idp-sync/okta-sync) documentation.
+
+
+NetBird's Okta integration enhances user management by allowing you to utilize Okta as your identity provider. This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management to your applications and resources.
+
+
+
+## OIDC-compliant IdPs
+
+For OIDC-compliant Identity Providers such as **Authentik**, **Keycloak**, **JumpCloud**, and **Auth0**, you'll need to configure the IdP
+to integrate with NetBird. Below are the steps to set up different OIDC-compliant IdPs with NetBird.
+
+
+ Support for OIDC-compliant IdPs is available on the Team plan and higher.
+ The Free plan supports Google, Microsoft, and social logins.
+
+
+### Authentik
+
+[Authentik](https://goauthentik.io/) is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols. Authentik includes audit logging, password policies, and full API access for automation.
+
+
+
+### Keycloak
+
+[Keycloak](https://www.keycloak.org/) is an open-source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IDP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols.
+
+
+
+### JumpCloud
+
+[JumpCloud](https://jumpcloud.com/) is a cloud-based directory platform that provides identity, access, and device management in a unified solution. It offers single sign-on, multi-factor authentication, directory services, device management, and network access control, providing a comprehensive approach to managing users, devices, and applications from a single platform.
+
+
+
+### Auth0
+
+[Auth0](https://auth0.com/) is a flexible, drop-in solution to add authentication and authorization services to your applications. It's a managed service that offers extensive customization options, developer-friendly APIs, universal login, social identity providers, and advanced security features like anomaly detection and breached password detection.
+
+
\ No newline at end of file
diff --git a/src/pages/manage/team/single-sign-on/jumpcloud.mdx b/src/pages/manage/team/single-sign-on/jumpcloud.mdx
new file mode 100644
index 00000000..cbab0db4
--- /dev/null
+++ b/src/pages/manage/team/single-sign-on/jumpcloud.mdx
@@ -0,0 +1,47 @@
+import {Note} from "@/components/mdx";
+
+# JumpCloud on NetBird Cloud
+
+You can use JumpCloud as your Identity Provider with NetBird, but it will require some additional configuration steps. JumpCloud is a cloud-based directory platform that provides identity, access, and device management in a unified solution. It offers single sign-on, multi-factor authentication, directory services, device management, and network access control, providing a comprehensive approach to managing users, devices, and applications from a single platform.
+
+1. Access the JumpCloud and navigate to USER AUTHENTICATION > SSO Applications
+
+2. Click + Add New Application, select Custom Application and click Next
+
+3. Enable Manage Single Sign-On (SSO), select Configure SSO with OIDC and click Next
+
+
+
+
+
+4. Add NetBird as Display Label and click Next. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
+
+5. Review the application setting and click Configure Application to proceed
+
+
+
+
+
+6. On the New Application screen, go to the SSO tab and under Endpoint Configuration set the following values:
+
+- Redirect URIs: https://login.netbird.io/login/callback
+
+- Login URL: https://app.netbird.io
+
+7. Under Attribute Mapping enable Email and Profile scopes
+
+
+ Sometimes, the Jumpcloud application configuration will add duplicate attributes, like email and email_verified. The duplicates should be removed.
+
+
+8. Go to the User Groups and select the list of groups to which you want to give access to the application and then click activate
+
+9. Record the Client ID and Client Secret that JumpCloud generates for your application.
+
+10. Share your Client ID, and Client Secret with our team. Please use a secure method for sharing this information.
+
+
+We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like:
+- https://onetimesecret.com/en/
+- https://password.link/en
+
\ No newline at end of file
diff --git a/src/pages/manage/team/single-sign-on/keycloak.mdx b/src/pages/manage/team/single-sign-on/keycloak.mdx
new file mode 100644
index 00000000..a4dc9598
--- /dev/null
+++ b/src/pages/manage/team/single-sign-on/keycloak.mdx
@@ -0,0 +1,57 @@
+import {Note} from "@/components/mdx";
+
+# Keycloak on NetBird Cloud
+
+You can use Keycloak as your Identity Provider with NetBird, but it will require some additional configuration steps. Keycloak is an open-source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IDP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols.
+
+1. You need to create a new client
+
+ - Browse to the clients Administration menu and then click in Create client:
+
+
+
+
+
+2. Create a client with the type OpenID Connect and add any client ID and name for the client:
+
+
+
+
+
+3. Click Next and enable the following options for Capability config:
+
+
+
+
+
+4. Click Next and fill the following fields:
+
+ Valid redirect URIs: `https://login.netbird.io/login/callback`
+ Web origins: `+`
+
+
+
+
+
+5. Click Save.
+
+6. Next we need to retrieve the secret for the client, you can get that in the Credentials tab for the client:
+
+
+
+
+
+7. Then, share the following information with the NetBird support team at support@netbird.io:
+
+- Client ID
+- Keycloak URL
+- Realm
+- Client Secret
+- Email domains for your users
+
+
+We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like:
+https://onetimesecret.com/en/
+https://password.link/en
+
+
diff --git a/src/pages/selfhosted/identity-providers.mdx b/src/pages/selfhosted/identity-providers.mdx
deleted file mode 100644
index 5a291843..00000000
--- a/src/pages/selfhosted/identity-providers.mdx
+++ /dev/null
@@ -1,1392 +0,0 @@
-import {Note} from "@/components/mdx";
-
-# Identity Providers
-
-There are a few Identity Provider options that you can choose to run a self-hosted version NetBird.
-
-
- NetBird supports generic OpenID (OIDC) protocol allowing for the integration with any IDP that follows the specification.
-
-
-## Self-hosted IDPs
-
-### Zitadel
-
-This guide is a part of the [NetBird Self-hosting Guide](/selfhosted/selfhosted-guide) and explains how to integrate
-**self-hosted** NetBird with [Zitadel](https://zitadel.com).
-
-
- If you prefer not to self-host an Identity and Access Management solution, then you could use the managed alternative
- [Zitadel Cloud](https://zitadel.com/).
-
-
-#### Step 1. Create and configure Zitadel application
-In this step, we will create and configure NetBird application in zitadel.
-
-Create new zitadel project
-- Navigate to zitadel console
-- Click `Projects` at the top menu, then click `Create New Project` to create a new project
-- Fill in the form with the following values and click `Continue`
-- Name: `NETBIRD`
-
-
-
-
-
-Create new zitadel application
-- Click `Projects` in the top menu and select `NETBIRD` project from the list
-- Click `New` in `APPLICATIONS` section to create a new application
-- Fill in the form with the following values and click `Continue`
-- Name: `netbird`
-- TYPE OF APPLICATION: `User Agent`
-
-
-
-
-
-- Fill in the form with the following values and click `Continue`
-- Authentication Method: `PKCE`
-
-
-
-
-
-- Fill in the form with the following values and click `Continue`
-- Redirect URIs: `https:///auth` and click `+`
-- Redirect URIs: `https:///silent-auth` and click `+`
-- Redirect URIs: `http://localhost:53000` and click `+`
-- Post Logout URIs: `https:///` and click `+`
-
-
-
-
-
-- Verify applications details and Click `Create` and then click `Close`
-- Under `Grant Types` select `Authorization Code`, `Device Code` and `Refresh Token` and click `save`
-
-
-
-
-
-- Copy `Client ID` will be used later in the `setup.env`
-
-#### Step 2: Application Token Configuration
-
-To configure `netbird` application token you need to:
-
-- Click `Projects` in the top menu and select `NETBIRD` project from the list
-- Select `netbird` application from `APPLICATIONS` section
-- Click `Token Settings` in the left menu
-- Fill in the form with the following values:
-- Auth Token Type: `JWT`
-- Check `Add user roles to the access token` checkbox
-- Click `Save`
-
-
-
-
-
-#### Step 3: Application Redirect Configuration
-
-
- This step is intended for setup running in development mode with no SSL
-
-
-To configure `netbird` application redirect you need to:
-
-- Click `Projects` in the top menu and select `NETBIRD` project from the list
-- Select `netbird` application from `APPLICATIONS` section
-- Click `Redirect Settings` in the left menu
-- Fill in the form with the following values:
-- Toggle `Development Mode`
-- Click `Save`
-
-
-
-
-
-#### Step 4: Create a Service User
-
-In this step we will create a `netbird` service user.
-
-- Click `Users` in the top menu
-- Select `Service Users` tab
-- Click `New`
-- Fill in the form with the following values:
-- User Name: `netbird`
-- Name: `netbird`
-- Description: `Netbird Service User`
-- Access Token Type: `JWT`
-- Click `Create`
-
-
-
-
-
-In this step we will generate `ClientSecret` for the `netbird` service user.
-
-- Click `Actions` in the top right corner and click `Generate Client Secret`
-- Copy `ClientSecret` from the dialog will be used later to set `NETBIRD_IDP_MGMT_CLIENT_SECRET` in the `setup.env`
-
-
-
-
-
-#### Step 5: Grant manage-users role to netbird service user
-
-In this step we will grant `Org User Manager` role to `netbird` service user.
-
-- Click `Organization` in the top menu
-- Click `+` in the top right corner
-- Search for `netbird` service user
-- Check `Org User Manager` checkbox
-- Click `Add`
-
-
-
-
-
-Your authority OIDC configuration will be available under:
-
-```bash
-https:///.well-known/openid-configuration
-```
-
-:::caution
-Double-check if the endpoint returns a JSON response by calling it from your browser.
-:::
-
-- Set properties in the `setup.env` file:
-```json
-NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https:///.well-known/openid-configuration"
-NETBIRD_USE_AUTH0=false
-NETBIRD_AUTH_CLIENT_ID=""
-NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
-NETBIRD_AUTH_AUDIENCE=""
-NETBIRD_AUTH_REDIRECT_URI="/auth"
-NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"
-
-NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="hosted"
-NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=""
-NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=""
-
-NETBIRD_MGMT_IDP="zitadel"
-NETBIRD_IDP_MGMT_CLIENT_ID="netbird"
-NETBIRD_IDP_MGMT_CLIENT_SECRET=""
-NETBIRD_IDP_MGMT_EXTRA_MANAGEMENT_ENDPOINT="https:///management/v1"
-NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true
-
-
-```
-
-#### Step 6: Continue with the NetBird Self-hosting Guide
-You've configured all required resources in Zitadel. You can now continue with the [NetBird Self-hosting Guide](/selfhosted/selfhosted-guide#step-4-disable-single-account-mode-optional).
-
-
-### Keycloak
-
-This guide is a part of the [NetBird Self-hosting Guide](/selfhosted/selfhosted-guide) and explains how to integrate
-**self-hosted** NetBird with [Keycloak](https://www.keycloak.org/).
-
-Keycloak is an open source software product to allow single sign-on with Identity and Access Management aimed at modern applications and services.
-
-
- If you prefer not to self-host an Identity and Access Management solution, then you could use a managed alternative like
- [Auth0](/selfhosted/identity-providers#auth0).
-
-
-The following guide is an adapted version of the original
-[Keycloak on Docker](https://www.keycloak.org/getting-started/getting-started-docker) guide from the official website.
-
-#### Expected Result
-
-After completing this guide, you can log in to your self-hosted NetBird Dashboard and add your machines
-to your network using the [Interactive SSO Login feature](/get-started/install#running-net-bird-with-sso-login)
-over Keycloak.
-
-
-
-
-
-#### Step 1: Check your Keycloak Instance
-
-For this guide, you need a fully configured Keycloak instance running with SSL.
-
-We assume that your Keycloak instance is available at **`https://YOUR-KEYCLOAK-HOST-AND_PORT`**.
-Feel free to change the port if you have configured Keycloak with a different one.
-
-Most of the OIDC software requires SSL for production use.
-We encourage you to comply with this requirement to make the world more secure 😊.
-
-#### Step 2: Create a realm
-
-To create a realm you need to:
-
-- Open the Keycloak Admin Console
-- Hover the mouse over the dropdown in the top-left corner where it says `Master`, then click on `Create Realm`
-- Fill in the form with the following values:
-- Realm name: `netbird`
-- Click `Create`
-
-
-
-
-
-
-#### Step 3: Create a user
-
-In this step we will create a NetBird administrator user.
-
-- Open the Keycloak Admin Console
-- Make sure, that the selected realm is `Netbird`
-- Click `Users` (left-hand menu)
-- Click `Create new user`
-- Fill in the form with the following values:
-- Username: `netbird`
-- Click `Create`
-
-
-
-
-
-The user will need an initial password set to be able to log in. To do this:
-- Click `Credentials` tab
-- Click `Set password` button
-- Fill in the password form with a password
-- Set the `Temporary` field to `Off` to prevent having to update password on first login
-- Click `Save`
-
-
-
-
-
-#### Step 4: Create a NetBird client
-
-In this step we will create NetBird application client and register with the Keycloak instance.
-
-- Open the Keycloak Admin Console
-- Make sure, that the selected realm is `Netbird`
-- Click `Clients`
-- Click `Create client` button
-- Fill in the form with the following values and click Next:
-- Client Type: `OpenID Connect`
-- Client ID: `netbird-client`
-- Your newly client `netbird-client` will be used later to set `NETBIRD_AUTH_CLIENT_ID` in the `setup.env`
-
-
-
-
-
-
-- Check the checkboxes as on the screenshot below and click Save
-
-
-
-
-
-#### Step 5: Adjust NetBird client access settings
-
-In this step we will configure NetBird application client access with the NetBird URLs.
-
-- Open the Keycloak Admin Console
-- Make sure, that the selected realm is `Netbird`
-- Click `Clients`
-- Choose `netbird-client` from the list
-- Go to `Access Settings` section
-- Fill in the fields with the following values:
-- Root URL: `https://YOUR DOMAIN/` (this is the NetBird Dashboard root URL)
-- Valid redirect URIs: `https://YOUR DOMAIN/*` and `http://localhost:53000`
-- Valid post logout redirect URIs: `https://YOUR DOMAIN/*`
-- Web origins: `+`
-- Click `Save`
-
-
-
-
-
-#### Step 6: Create a NetBird client scope
-
-In this step, we will create and configure the NetBird client audience for Keycloak to add it to the generated JWT tokens.
-
-- Open the Keycloak Admin Console
-- Make sure, that the selected realm is `Netbird`
-- Click `Client scopes` (left-hand menu)
-- Click `Create client scope` button
-- Fill in the form with the following values:
-- Name: `api`
-- Type: `Default`
-- Protocol: `OpenID Connect`
-- Click `Save`
-
-
-
-
-
-- While in the newly created Client Scope, switch to the `Mappers` tab
-- Click `Configure a new mapper`
-- Choose the `Audience` mapping
-
-
-
-
-
-- Fill in the form with the following values:
-- Name: `Audience for NetBird Management API`
-- Included Client Audience: `netbird-client`
-- Add to access token: `On`
-- Click `Save`
-
-
-
-
-
-#### Step 7: Add client scope to NetBird client
-
-- Open the Keycloak Admin Console
-- Make sure, that the selected realm is `Netbird`
-- Click `Clients`
-- Choose `netbird-client` from the list
-- Switch to `Client scopes` tab
-- Click `Add client scope` button
-- Choose `api`
-- Click `Add` choosing `Default`
-- The value `netbird-client` will be used as audience
-
-
-
-
-
-#### Step 8: Create a NetBird-Backend client
-
-In this step we will create NetBird backend client and register with the Keycloak instance.
-
-- Open the Keycloak Admin Console
-- Make sure, that the selected realm is `Netbird`
-- Click `Clients`
-- Click `Create client` button
-- Fill in the form with the following values and click Next:
-- Client Type: `OpenID Connect`
-- Client ID: `netbird-backend`
-- Your newly client `netbird-backend` will be used later to set `NETBIRD_IDP_MGMT_CLIENT_ID` in the `setup.env`
-
-
-
-
-
-- Check the checkboxes as on the screenshot below and click Save
-
-
-
-
-
-The client will need secret to authenticate. To do this:
-- Click `Credentials` tab
-- Copy `client secret` will be used later to set `NETBIRD_IDP_MGMT_CLIENT_SECRET` in the `setup.env`
-
-
-
-
-
-#### Step 9: Add view-users role to netbird-backend
-
-- Open the Keycloak Admin Console
-- Make sure, that the selected realm is `Netbird`
-- Click `Clients`
-- Choose `netbird-backend` from the list
-- Switch to `Service accounts roles` tab
-- Click `Assign roles` button
-- Select `Filter by clients` and search for `view-users`
-
-
-
-
-
-- Check the role checkbox and click assign
-
-
-
-
-
-
-Optional
-
-NetBird offers the ability to automatically delete a user from the Keycloak side when the user is deleted from the associated account.
- To enable this functionality, simply include the `--user-delete-from-idp` flag in the management startup command within your Docker Compose configuration. If you choose to enable this feature,
- please ensure that you assign the `manage-users` role to the `netbird-backend` following the steps outlined above.
-
-
-Your authority OIDC configuration will be available under:
-```bash
-https:///realms/netbird/.well-known/openid-configuration
-```
-
- Double-check if the endpoint returns a JSON response by calling it from your browser.
-
-
-- Set properties in the `setup.env` file:
-```shell
-NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT=`https:///realms/netbird/.well-known/openid-configuration`.
-NETBIRD_USE_AUTH0=false
-NETBIRD_AUTH_CLIENT_ID=`netbird-client`
-NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
-NETBIRD_AUTH_AUDIENCE=`netbird-client`
-
-NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=`netbird-client`
-NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=`netbird-client`
-
-NETBIRD_MGMT_IDP="keycloak"
-NETBIRD_IDP_MGMT_CLIENT_ID="netbird-backend"
-NETBIRD_IDP_MGMT_CLIENT_SECRET=""
-NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT="https:///admin/realms/netbird"
-
-```
-
- Make sure that your Keycloak instance use HTTPS. Otherwise, the setup won't work.
-
-
-#### Step 10: Continue with the NetBird Self-hosting Guide
-You've configured all required resources in Keycloak. You can now continue with the [NetBird Self-hosting Guide](/selfhosted/selfhosted-guide#step-4-disable-single-account-mode-optional).
-
-### Authentik
-
-This guide is a part of the [NetBird Self-hosting Guide](/docs/selfhosted/selfhosted-guide) and explains how to integrate
-**self-hosted** NetBird with [Authentik](https://goauthentik.io).
-
-
- If you prefer not to self-host an Identity and Access Management solution, then you could use a managed alternative like
- [Auth0](/selfhosted/identity-providers#auth0).
-
-
-#### Step 1: Create OAuth2/OpenID Provider
-In this step, we will create OAuth2/OpenID Provider in Authentik.
-
-- Navigate to authentik admin interface
-- Click `Applications` on the left menu, then click `Providers`
-- Click `Create` to create new provider
-- Fill in the form with the following values and click `Next`
- - type: `OAuth2/OpenID Provider`
-
-
-
-
-
-- Fill in the form with the following values and click `Finish`
- - Name: `Netbird`
- - Authentication Flow: `default-authentication-flow (Welcome to authentik!)`
- - Authorization Flow: `default-provider-authorization-explicit-consent (Authorize Application)`
- - Protocol Settings:
- - Client type: `Public`
- - Redirect URIs/Origins (RegEx):
- - Regex: `https:///.*`
- - Strict: `http://localhost:53000`
- - Signing Key: Must be selected! Can be any cert present, e.g. `authentik Self-signed Certificate`
- - Advanced protocol settings:
- - Access code validity: `minutes=10`
- - Subject mode: `Based on the User's ID`
-
-Take note of `Client ID`, we will use it later
-
-
-
-
-#### Step 2: Create external applications
-In this step, we will create external applications in Authentik.
-
-- Navigate to authentik admin interface
-- Click `Applications` on the left menu, then click `Applications`
-- Click `Create` to create new application
-- Fill in the form with the following values and click `Create`
- - Name: `Netbird`
- - Slug: `netbird`
- - Provider: `Netbird`
-
-
-
-
-
-#### Step 3: Create service account
-In this step, we will create service account.
-
-- Navigate to authentik admin interface
-- Click `Directory` on the left menu, then click `Users`
-- Click `Create Service Account` to create service account
-- Fill in the form with the following values and click `Create`
- - Username: `Netbird`
- - Create Group: `Disable`
-
-
-
-
-
-- Take note of the NetBird service account `username`, we will need it later.
-- N.B. The `password` defined when creating the NetBird service account is not required.
-Users should instead create an app password for the NetBird service account within `Directory > Tokens and App passwords` in authentik's `Admin interface.
-Be sure to select the NetBird Service account object as the `User` when creating the app password.
-Take note of the app password as we will need it later.
-
-
-
-
-
-#### Step 4: Add service account to admin group
-In this step, we will add `Netbird` service account to `authentik Admins` group.
-
-- Navigate to authentik admin interface
-- Click `Directory` on the left menu, then click `Groups`
-- Click `authentik Admins` from list of groups and select `Users` tab at the top
-- Click `Add existing user` and click `+` button to add user
-- Select `Netbird` and click `Add`
-- Disable `Hide service-accounts` and verify if user `Netbird` is added to the group
-
-
-
-
-
-#### Step 5: Create a authentication flow for device token authentication
-
-- Navigate to authentik admin interface
-- Click `Flows and Stages` on the left menu, then click `Flows` then `Create`
-- Fill in the form with the following values and click `Create`
- - Name: `default-device-code-flow`
- - Title: `Device Code Flow`
- - Designation: `Stage Configuration`
- - Authentication: `Require authentication`
-
-
-
-
-
-- Navigate to authentik admin interface
-- Click `System` on the left menu, then click `Brands`
-- Click on the edit button of domain `authentik-default`
-- Under Default flows set Device code flow to `default-device-code-flow`
-- Click `Update`
-
-
-
-
-
-Your authority OIDC configuration will be available under:
-
-```bash
-https://< YOUR_AUTHENTIK_HOST_AND_PORT >/application/o/netbird/.well-known/openid-configuration
-```
-
-
-Double-check if the endpoint returns a JSON response by calling it from your browser.
-
-
-- Set properties in the `setup.env` file:
-```shell
-NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https:///application/o/netbird/.well-known/openid-configuration"
-NETBIRD_USE_AUTH0=false
-NETBIRD_AUTH_CLIENT_ID=""
-NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
-NETBIRD_AUTH_AUDIENCE=""
-NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=""
-NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=""
-NETBIRD_AUTH_REDIRECT_URI="/auth"
-NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"
-
-NETBIRD_MGMT_IDP="authentik"
-NETBIRD_IDP_MGMT_CLIENT_ID=""
-NETBIRD_IDP_MGMT_EXTRA_USERNAME="Netbird"
-NETBIRD_IDP_MGMT_EXTRA_PASSWORD=""
-
-# needs disabling due to issue with IdP. Learn more [here](https://github.com/netbirdio/netbird/issues/3654)
-NETBIRD_AUTH_PKCE_DISABLE_PROMPT_LOGIN=true
-
-```
-
-#### Step 6: Continue with the NetBird Self-hosting Guide
-You've configured all required resources in Authentik. You can now continue with the [NetBird Self-hosting Guide](/selfhosted/selfhosted-guide#step-4-disable-single-account-mode-optional).
-
-### PocketID
-
-This guide is a part of the [NetBird Self-hosting Guide](/docs/selfhosted/selfhosted-guide) and explains how to integrate
-**self-hosted** NetBird with [PocketID](https://pocket-id.org/).
-
-
- PocketID is a simplified identity management solution designed for self hosted environments.
- It is secure and effective, but makes some tradeoffs in terms of features and usability.
- Notably, it does not allow scoping the access of API Tokens.
- This isn't an issue per se, but it does mean that you should keep careful track of the token used by NetBird for management.
-
-
-#### Step 1. Create and configure PocketID application
-In this step, we will create and configure NetBird application in pocketid.
-
-Create new PocketID OIDC Client
-- Navigate to pocketid console
-- Click the `Administration` dropdown in the left hand bar, then select `OIDC Clients`
-- Fill in the form with the following values and click `Continue`
-- Name: `NetBird`
-- Client Launch URL: `https://`
-- Callback URL's:
-- `http://localhost:53000`
-- `https:///auth`
-- `https:///silent-auth`
-- Logout Callback URL: `https:///`
-- Public Client: On
-- PKCE: On
-- Click `Save`
-
-
-
-
-
-- Copy `Client ID` will be used later in the `setup.env`
-
-#### Step 2: Application Token Configuration
-
-To configure the application token you need to:
-
-- Click `Administration` dropdown in the left hand bar, then select `API Keys`
-- Click `Add API Key`
-- Enter the following values and click `Save`
-- Name: 'NetBird Management Token'
-- Expires At: Pick a date in the future
-- Description: 'NetBird Management Token'
-- Click `Save`
-
-
-
-
-
-- Copy `API Key` will be used later in the `setup.env`
-
-
-Your authority OIDC configuration will be available under:
-
-```bash
-https:///.well-known/openid-configuration
-```
-
-:::caution
-Double-check if the endpoint returns a JSON response by calling it from your browser.
-:::
-
-- Set properties in the `setup.env` file:
-```json
-NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https:///.well-known/openid-configuration"
-NETBIRD_USE_AUTH0=false
-NETBIRD_AUTH_CLIENT_ID=""
-NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email groups"
-NETBIRD_AUTH_AUDIENCE=""
-NETBIRD_AUTH_REDIRECT_URI="/auth"
-NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"
-NETBIRD_TOKEN_SOURCE="idToken"
-
-NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"
-NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=""
-NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=""
-NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid profile email groups"
-NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=true
-
-NETBIRD_MGMT_IDP="pocketid"
-NETBIRD_IDP_MGMT_CLIENT_ID="netbird"
-NETBIRD_IDP_MGMT_EXTRA_MANAGEMENT_ENDPOINT="https://"
-NETBIRD_IDP_MGMT_EXTRA_API_TOKEN=""
-
-```
-
-#### Step 3: Continue with the NetBird Self-hosting Guide
-You've configured all required resources in PocketID. You can now continue with the [NetBird Self-hosting Guide](/selfhosted/selfhosted-guide#step-4-disable-single-account-mode-optional).
-
-
-## Managed IDPs
-
-### Azure AD (Microsoft Entra ID)
-
-This guide is a part of the [NetBird Self-hosting Guide](/selfhosted/selfhosted-guide) and explains how to integrate **self-hosted** NetBird with [Azure AD](https://azure.microsoft.com/en-us/products/active-directory/).
-
-Azure AD is a an enterprise identity service that provides single sign-on and multifactor authentication to your applications.
-It is a 3rd party managed service and can't be self-hosted.
-
-
- If you prefer to have full control over authentication and authorization of your NetBird network, there are good
- self-hosted alternatives to the managed Auth0 service like [Keycloak](/selfhosted/identity-providers#keycloak).
-
-
-Before you start creating and configuring an Azure AD application, ensure that you have the following:
-- An Azure account: To create an Azure AD application, you must have an Azure account. If you don't have one, sign up for a free account at https://azure.microsoft.com/free/.
-
-- User account with appropriate permissions: You must have an Azure AD user account with the appropriate permissions to create and manage Azure AD applications. If you don't have the required permissions, ask your Azure AD administrator to grant them to you.
-
-
-#### Step 1. Create and configure Azure AD application
-In this step, we will create and configure NetBird application in azure AD.
-- Navigate to [Azure Active Directory](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview)
-- Click `App Registrations` in the left menu then click on the `+ New registration` button to create a new application.
-- Fill in the form with the following values and click Register
- - Name: `Netbird`
- - Account Types: `Accounts in this organizational directory only (Default Directory only - Single tenant)`
- - Redirect URI: select `Single-page application (SPA)` and URI as `https:///silent-auth`
-
-
-
-
-
-#### Step 2. Platform configurations
-- Click `Authentication` on the left side menu
-- Under the `Single-page application` Section, add another URI `https:///auth`
-
-
-
-
-
-- Scroll down and setup other options as on the screenshot below and click Save
-
-
-
-
-
-- Click `Add a Platform` and select `Mobile and desktop applications`
-- Fill in the form with the following values and click Configure
- - Custom redirect URIs: `http://localhost:53000`
-
-
-
-
-#### Step 3. Create a NetBird application scope
-- Click `Expose an API` on the left menu
-- Under `Application ID URI` click `Set` and then `Save`
-- Click `+ Add a Scope`
-- Fill in the form with the following values and click `Add scope`
-- Scope name: `api`
-
-
-
-
-
-- Under `Authorized client Applications`, click on `+ add a client application` and enter the following:
-- Fill in the form with the following values and click `Add application`
-- Client ID: same as your Application ID URI minus the `api://`
-
-
-
-
-
-
-#### Step 4. Add API permissions
-Add `Netbird` permissions
-
-- Click `API permissions` on the left menu
-- Click `Add a permission`
-- Click `My APIs` tab, and select `Netbird`. Next check `api` permission checkbox and click `Add permissions`.
-
-
-
-
-
-Add `Delegated permissions` to Microsoft Graph
-
-- Click `Add a permission`
-- Click `Microsoft Graph` and then click `Application permissions` tab
-- In `Select permissions` search for `User.Read` and under the `User` section select `User.Read.All` and click `Add permissions`
-
-
-
-
-
-
-- Click `Grant admin consent for Default Directory` and click `Yes`
-
-
-
-
-
-#### Step 5. Update token version
-- Click `Manifest` on left menu
-- Search for `accessTokenAcceptedVersion` and change the value from `null` to `2`
-- Click `Save`
-
-#### Step 6. Generate client secret
-- Click `Certificates & secrets` on left menu
-- Click `New client secret`
-- Fill in the form with the following values and click `Add`
-- Description: `Netbird`
-- Copy `Value` and save it as it can be viewed only once after creation.
-
-
-
-
-
-- Click `Overview` on left menu and take note of `Application (client) ID`, `Object ID` and `Directory (tenant) ID`
-will be required in next step.
-
-Your authority OIDC configuration will be available under:
-```bash
-https://login.microsoftonline.com//v2.0/.well-known/openid-configuration
-```
-
- Double-check if the endpoint returns a JSON response by calling it from your browser.
-
-
-- Set properties in the `setup.env` file:
-```shell
-NETBIRD_DOMAIN=""
-NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://login.microsoftonline.com//v2.0/.well-known/openid-configuration"
-NETBIRD_USE_AUTH0=false
-NETBIRD_AUTH_CLIENT_ID=""
-NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access User.Read api:///api"
-NETBIRD_AUTH_AUDIENCE=""
-NETBIRD_AUTH_REDIRECT_URI="/auth"
-NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"
-NETBIRD_AUTH_USER_ID_CLAIM="oid"
-NETBIRD_TOKEN_SOURCE="idToken"
-
-NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"
-
-NETBIRD_MGMT_IDP="azure"
-NETBIRD_IDP_MGMT_CLIENT_ID=""
-NETBIRD_IDP_MGMT_CLIENT_SECRET=""
-NETBIRD_IDP_MGMT_EXTRA_OBJECT_ID="
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-