---
title: Custom Zones | Keycard
description: Create a custom Zone and configure admin access and user authentication
---

A [Zone](/concepts/zones/index.md) is a security domain for a set of users, Applications, and Resources. Custom Zones support advanced use cases, such as building systems with a different set of external users than your organization for example, a customer-facing product with its own user pool, or separate environments with their own security controls.

Note

Your organization is already a Zone, with no separate setup required. Create a custom Zone only when you need a separate set of users or an isolated security domain. See [Zones](/concepts/zones/index.md) for the full concept.

Because a custom Zone has its own users, it requires additional configuration beyond creating it:

1. An organization Admin must assign explicit management access to the Zone, including themselves.
2. The Zone needs an Identity Provider so its users can sign in: either your Organization Zone, or an external Identity Provider such as Okta, Auth0, or Google.

## Prerequisites

Only organization **Admins** can create Zones and assign Zone access. See [Roles & Permissions](/admin/roles-and-permissions/index.md).

## Create a Zone

1. **Open the Zones page**

   In Keycard Console, click **Zones** in the sidebar.

2. **Create the Zone**

   Click **Create Zone**, enter a **Name**, and click **Create**.

## Assign Zone Admin Access

Custom Zones have their own management roles: **Manager** (full access to the Zone) and **Viewer** (read-only). An organization Admin must assign these roles explicitly.

Caution

Organization Admins are not automatically Managers of custom Zones. Assign yourself **Manager** access to the Zone you just created, or you will not be able to manage it.

1. Open the **People** page.
2. Find the member and click the **⋯** button on their row to open their access drawer.
3. Under **Zone access**, choose **Manager** for the new Zone.
4. Repeat for yourself and anyone else who needs to manage the Zone.

See [Roles & Permissions](/admin/roles-and-permissions/index.md) for details on organization and Zone roles.

## Configure Zone Authentication

Every custom Zone needs an Identity Provider so its users can sign in. There are two options.

### Use your Organization Zone as the Identity Provider

Every Keycard Zone can act as an Identity Provider for other Zones. If the custom Zone’s users are members of your organization, connect your Organization Zone as the custom Zone’s Identity Provider. Users then sign in to the custom Zone with their organization accounts.

1. **Copy your Organization Zone’s Issuer URL**

   In Keycard Console, go to **Settings** → **Connection** and copy the **Issuer URL** of your Organization Zone.

2. **Create a Provider in the custom Zone**

   1. Switch to the custom Zone, click **Providers** in the sidebar, and then **Add Provider**.
   2. Enter a **Name**, such as “Organization”.
   3. In the **Issuer URL** field, enter the Organization Zone’s Issuer URL you copied.
   4. Click **Connect**.

3. **Select the Provider for the Zone**

   1. Go to **Zones**, open the **⋯** menu on your Zone’s card, and select **Settings**.
   2. On the **Settings** tab, in the **Zone sign in configuration** section, open the **Identity Provider** dropdown and select the Provider you just created.
   3. Click **Save Changes**.

### Use an external Identity Provider as the source of truth

If your Zone’s users already have accounts in an Identity Provider such as Okta, Auth0, or Google, connect it and select it as the Zone’s Identity Provider. Users then sign in to the Zone with their existing accounts.

1. Connect your Provider by following [Identity Providers](/admin/identity-providers/index.md).
2. Go to **Zones**, open the **⋯** menu on your Zone’s card, and select **Settings**.
3. On the **Settings** tab, in the **Zone sign in configuration** section, open the **Identity Provider** dropdown and select your Provider.
4. Click **Save Changes**.

For end-to-end Provider setup, see the [Okta](/admin/tutorials/okta-sign-in/index.md) and [Auth0](/admin/tutorials/auth0-sign-in/index.md) tutorials.

## Next Steps

- Control what the Zone’s users and agents can access with [Access Policies](/admin/access-policies/index.md).
- Add [Applications](/concepts/applications/index.md) and [Resources](/concepts/resources/index.md) to the Zone.