ThoughtSpot provides either SAML or local ThoughtSpot accounts to authenticate users.

ThoughtSpot provides two ways to authenticate users: SAML (Security Association Markup Language) and ThoughtSpot local accounts. ThoughtSpot recommends that you use SAML for authentication, since it is industry-standard and enables Single-Sign On (SSO) with your Identity Provider (IdP).

Use the following table to help you choose an authentication option.

SAML	ThoughtSpot
Use SAML for single sign-on authentication. Can redirect from ThoughtSpot to SAML logins. Recommended for portal integration.	User created and managed in ThoughtSpot. Password strength control Only recommended when SAML is not an option.

All users and groups must be known to ThoughtSpot. If you are using SAML and don’t create users in ThoughtSpot, a user is created when the user first logs in. However, this user is assigned to the All group and can only see content available for all users.

Groups are the primary way that security is managed. Groups are not automatically created. You can create groups and users manually, or you must automate the assignment from a source system. ThoughtSpot has public APIs that you can use to sync users and groups between source systems and your ThoughtSpot appliance.