Custom Zones

A Zone is a security domain for a set of users, Applications, and Resources. Custom Zones support advanced use cases, such as building systems with a different set of external users than your organization for example, a customer-facing product with its own user pool, or separate environments with their own security controls.

Because a custom Zone has its own users, it requires additional configuration beyond creating it:

1. An organization Admin must assign explicit management access to the Zone, including to themselves: turn on Add me as a Manager when creating the Zone, or assign it afterward.
2. Decide how its users sign in. A new custom Zone has no sign-in until you select an Identity Provider: either your Organization Zone, or an external one such as Okta, Microsoft Entra ID, Ping Identity, Auth0 or Google.

Only organization Admins can create Zones and assign Zone access. See Roles & Permissions.

1. Open the Zones page

   In Keycard Console, click Zones in the sidebar.

2. Create the Zone

   Click Create Zone, enter a Name, turn on Add me as a Manager, and click Create. Console makes you a Manager of the new Zone and switches you into it.

Custom Zones have their own management roles: Manager (full access to the Zone) and Viewer (read-only). An organization Admin must assign these roles explicitly.

1. Open the People page.
2. Find the member and click the ⋯ button on their row to open their access drawer.
3. Under Zone access, choose Manager for the new Zone.
4. Repeat for yourself and anyone else who needs to manage the Zone.

See Roles & Permissions for details on organization and Zone roles.

A new custom Zone has no sign-in until you select an Identity Provider for it, so connect one to let users sign in with accounts they already have. Authenticate users with your identity provider walks through Okta, Microsoft Entra ID, Auth0, Google and PingOne, and Configure Zone sign-in covers the setting itself. There are two ways to connect one.

Every Keycard Zone can act as an Identity Provider for other Zones. If the custom Zone’s users are members of your organization, connect your Organization Zone as the custom Zone’s Identity Provider. Users then sign in to the custom Zone with their organization accounts.

1. Copy your Organization Zone’s Issuer URL

   Creating the Zone switched you into it, and its own settings show the custom Zone’s Issuer URL. Click Back to your organization in the sidebar, then Settings under Organization. On the Connection tab, copy the Issuer URL.

2. Switch to the custom Zone

   Click Zones in the sidebar, open the ⋯ menu on the custom Zone’s card, and select Switch to zone. A Provider belongs to the Zone you create it in, so do this before the next step.

3. Create the Provider

   1. Click Providers in the sidebar, and then Add Provider.
   2. Enter a Name, such as “Organization”.
   3. In the Issuer URL field, enter the Organization Zone’s Issuer URL you copied.
   4. Leave Client ID and Client Secret empty. At the first sign-in, Keycard registers itself with your Organization Zone and fills in the Client ID.
   5. Click Create Provider.

4. Select the Provider for the Zone

   1. Open the Zones list: inside a custom Zone the sidebar has no Zones item, so click Back to your organization in the sidebar, then Zones. Open the ⋯ menu on your Zone’s card, and select Settings.

   2. On the Settings tab, in the Zone sign in configuration section, open the Identity Provider dropdown and select the Provider you just created.

   3. Click Save Changes.

If your Zone’s users already have accounts in an Identity Provider such as Okta, Microsoft Entra ID, Ping Identity, Auth0, or Google, connect it and select it as the Zone’s Identity Provider. Users then sign in to the Zone with their existing accounts.

1. Switch to the custom Zone: click Zones in the sidebar, open the ⋯ menu on its card, and select Switch to zone. A Provider belongs to the Zone you create it in.
2. Connect your Provider by following Identity Providers.
3. Click Back to your organization in the sidebar (inside a custom Zone the sidebar has no Zones item), then Zones. Open the ⋯ menu on your Zone’s card, and select Settings.
4. On the Settings tab, in the Zone sign in configuration section, open the Identity Provider dropdown and select your Provider.
5. Click Save Changes.

For end-to-end Provider setup, see the Okta, Microsoft Entra ID, Ping Identity, and Auth0 tutorials.

• Control what the Zone’s users and agents can access with Access Policies.
• Add Applications and Resources to the Zone.