Foldr authenticates against the identity provider you already run. Once someone’s signed in, what they can open comes from the permissions you’ve set in Foldr and, on an SMB file server, from the server’s own rules too.
Pick one or several; you switch each on in Settings. Foldr supports stacking strategies, so a school can run Entra for staff and SAML for parents on the same instance. One address, one account: Foldr checks your directory first, then outside accounts, then local ones, and stops at the first match, so nobody ends up as two people.
Works with any compliant provider, including Entra and Google.
Native Graph integration. Your Conditional Access policies apply at sign-in.
Group sync and attribute mapping, on a Foldr appliance in your own network. (Foldr Cloud signs people in with Entra or SAML instead.)
Desktop sign-in without a password prompt on AD-joined networks. Foldr appliance only.
For service users and edge cases. You can require two-factor for them like anyone else.
Run Foldr as a SAML 2.0 identity provider and downstream apps sign in against it. No separate IdP licence, no per-user premium other vendors charge for the privilege of SSO. Every auth control that protects Foldr also protects every app that signs in through it: MFA, passkeys, trusted devices, audit logging, IP rules.
Every protection on Foldr’s own login covers the IdP login too. TOTP authenticator apps, Duo push, and FIDO2/WebAuthn passkeys. Trusted-device flags. Sudo re-prompts on sensitive actions. The MFA premium other IdPs charge isn’t a line item here.
Every sign-in attempt, MFA challenge and session is recorded centrally. Per-user, per-app, per-device. Downloadable as CSV; retained per your policy. No P1 tier upsell, no separate logging service to wire in.
Add a starter and they’re in everywhere downstream that signs in via Foldr. Disable a leaver and Foldr stops signing them in to everything downstream. (An app that already holds its own session for them keeps it until it ends, unless it supports single logout.) Group membership is asserted at sign-in via SAML claims; provisioning lifecycle stays at the IdP.
Standard metadata exchange, signed assertions, name-ID and attribute mapping configurable per app. Works with the SAML-aware SaaS you already run.
Allow- and blocklist by IP at the IdP layer. Combine with per-device approval and trusted-device flags to gate which apps see which users from where.
If you have Foldr, you have this. No extra licence to buy, no “Identity” tier upsell. The same MFA, passkeys, audit and group sync used for Foldr logins are exposed to downstream apps the same way.
Useful for schools running a flat directory, MSPs consolidating identity for clients, and any team with a SaaS estate that doesn’t want to budget for Okta or Entra P1 on top of everything else.
SSO answers one question: who is this person? It doesn’t answer what they should be able to read. Foldr has its own permissions, set per share, and on an SMB file server the server can still say no, because a signed-in person opens it with their own credentials. A share can filter every file by its ACLs too, and a link only ever carries what its creator could see.
TOTP authenticator apps, Duo push, and FIDO2/WebAuthn passkeys. Trusted-device flags so users on the same laptop aren’t prompted every login. Sudo mode for sensitive admin actions.
Try it free for 30 days, no credit card. Or get in touch about self-hosting.
