Skip to main content

Quick start

This guide takes a new tenant from first sign-in to a first access review. You need the administrator role in your tenant. Most steps happen in Ciyora Console > Settings; each step links to the concept behind it.

1. Sign in to Ciyora Console​

Open the console address you received from ZPOA and choose Sign in. Ciyora Console sends you to the sign-in page of the Ciyora identity service; after you sign in, it returns you to the console with your company selected.

If you belong to more than one company, switch between them with the company switcher at the top of the console. See Tenants.

2. Set up single sign-on​

Go to Settings > Single sign-on and add a connection:

  1. Choose SAML or OIDC and enter the values from your identity provider. The page lists the service-provider values your identity provider needs, with copy buttons.
  2. Add and verify your email domain. The page shows the DNS TXT record to publish.
  3. Run the readiness test and fix anything it reports.
  4. Activate the connection. Only one connection per protocol is active at a time.

Client secrets and SCIM tokens are write-only: once saved, they show as Stored (hidden). Keep an administrator able to sign in until you have tested SSO with a second account.

3. Connect your identity and HR sources​

Go to Settings > Connectors, open the Catalog tab and choose a connector, for example your HR system and your directory or identity provider. Add connector opens a form built from the connector's settings; secrets are write-only.

  • Mark the HR connector as the authoritative source for joiners, movers and leavers.
  • Use Test and Health before the first sync.
  • Creating or changing a connector may wait in the approval centre, depending on your tenant's policy.

After the first sync, people and accounts appear under Identity. Review Identity > Account mapping for accounts Ciyora could not match to a person. See Identities.

4. Add a site gateway​

A site gateway connects an office, data centre or cloud network to the Ciyora VPN mesh. It connects outbound, so you do not open inbound ports.

  1. Go to Network > Enrolment keys and create a key for the gateway. Set an expiry and tags. The full key is shown once; copy it then.
  2. Install the gateway on a Linux VM or as a container in that network and start it with the key. Your ZPOA contact provides the package for your environment.
  3. When it appears under Network > Overview and gateways, go to Network > Routes and approve the subnets it advertises.
  4. Write access rules under Network > Access controls. Anything not allowed is denied.

See Gateways and the mesh.

5. Enrol devices with Ciyora Client​

  1. Create an enrolment key for people's devices under Network > Enrolment keys, or an agent enrolment token under Settings > Agent enrollment if you also deploy the endpoint agent.
  2. Distribute Ciyora Client. Employees can download it from Downloads in the employee portal; for managed fleets, deploy the installer and a connection profile through your MDM.
  3. Check Network > Devices: each device shows its mesh address, key expiry, path and posture.

6. Run your first access review​

  1. Go to Governance > Access reviews and start a campaign, for example a manager review of one application.
  2. Reviewers certify or revoke each item. High-risk items and items in a separation-of-duties conflict need a written reason.
  3. When the campaign ends, use Export evidence to download the evidence pack (CSV or JSON).

Every decision is written to the audit chain.

Next steps​

  • Read the concepts.
  • Set up the modules you bought: module guides.
  • Choose the language model for Zara under Settings > AI providers. See Zara.