Versa IdP is Versa Networks’ built-in identity provider, used to authenticate users of Titan Portal and SASE gateways. Instead of each device managing its own local user database, Versa IdP centralizes accounts: administrators create Versa IdP users once, and those identities can be referenced directly in firewall, decryption, and traffic-steering rules.
Key takeaways
- Versa IdP is Versa’s built-in identity provider for Titan Portal users.
- Replaces per-device local authentication with one centralized identity store.
- New Versa IdP users get an email to set their portal password.
- Versa IdP profiles apply directly in firewall and steering match rules.
- An alternative to external IdPs like Okta or ADFS, or to VSPA auth.
On this page: Why it mattersHow it worksHow Versa IdP worksVersa IdP & the VersaONE platformFAQ
Why is Versa IdP important?
A SASE estate spans many gateways, tenants, and portals; if every device kept its own local user list, provisioning and deprovisioning an employee would mean touching each one separately, and a departing user’s access could linger anywhere it was never revoked. Versa IdP exists to remove that sprawl: one identity, created once in Titan Portal, that every policy referencing users or groups can trust.
That centralization pays off directly in policy. Firewall, decryption, and traffic-steering rules can all match on Versa IdP user or group identity, so access decisions follow the person rather than the device they happen to be using. For SASE gateway and remote-access authentication specifically, Versa IdP is the credential store the gateway checks before granting a session, making identity a first-class input to security policy.
What is Versa IdP?
Versa IdP is one of three platform options Titan Portal offers when creating a user account, alongside External (authentication routed to a third-party IdP such as Okta, OneLogin, or ADFS) and VSPA (RAC/RAS) (local authentication on the SASE gateway or remote-access client itself). Choosing Versa IdP creates the account in Versa’s own portal database; the new user receives an email with instructions to set their password.
Beyond portal login, a Versa IdP profile can be selected as User and Group match criteria in firewall, decryption, and steering rules, and is required for VSA/remote-access VPN authentication in a device template. Newly created Versa IdP users take up to 60 minutes to appear in that profile, because Versa Director’s LDAP cache scheduler refreshes user and group information from VOS on that interval by default.
How Versa IdP works
An administrator with sufficient privilege – operator, store admin, MSP, reseller, or enterprise admin – adds a user from the Users dashboard and selects Versa IDP as the platform. Titan Portal creates the account in its own database and emails the user a link to set their password; no external system is involved. A tenant is not limited to one platform: Versa IDP, External, and VSPA (RAC/RAS) can all be enabled simultaneously for the same organization, letting different users authenticate different ways.
Once created, a Versa IdP identity becomes available wherever Versa Director resolves user or group information – most directly, the Versa IdP profile in firewall, decryption, and steering rules.
Versa IdP & the VersaONE platform
Versa IdP sits inside Titan Portal, the cloud dashboard used to deploy, configure, and manage Secure SD-WAN branch devices, organizations, and users. The identities it creates are consumed downstream by Versa Director, which resolves them into the User and Group match criteria available in firewall, decryption, and traffic-steering rules pushed to VOS devices – including SASE gateways enforcing remote-access authentication.
Versa IdP is deliberately one option among several rather than a mandatory dependency: tenants that already run an external IdP can route authentication there instead, and SASE gateways offering Versa Secure Private Access can authenticate remote-access clients locally through VSPA. All three converge on the same Director-managed policy surface once a user’s identity is established.
Frequently asked questions
What is the difference between Versa IdP and an external identity provider?
Versa IdP creates and stores the account in Versa’s own portal database, with Titan Portal emailing the user to set a password. An external IdP (Okta, OneLogin, ADFS, Ping) instead authenticates the user itself; Titan Portal routes the login request there and consumes the resulting assertion.
How do I create a Versa IdP user in Titan Portal?
From the Users dashboard, click Add User, enter the user’s name and email, and select Versa IDP as the platform along with a role such as Enterprise Admin or Enterprise User. Titan Portal creates the account and emails the user instructions to set their password.
Can a tenant use more than one identity platform at once?
Yes. Versa IDP, External, and VSPA (RAC/RAS) can all be enabled for the same organization simultaneously. An administrator chooses the platform per user when creating or editing the account, so different users in one tenant can authenticate different ways side by side.
Why does a new Versa IdP user take time to appear in match criteria?
Versa Director caches user and group information fetched from VOS and refreshes it on an LDAP cache scheduler interval of 60 minutes by default. Creating or deleting a Versa IdP user, or enabling Versa IdP for a new organization, only becomes visible in policy after that refresh completes.
Does Versa IdP work with SASE gateways, or only Titan Portal users?
Both. Versa IdP authenticates Titan Portal administrator and user accounts, and a Versa IdP profile can also be selected as match criteria for SASE gateway and remote-access VPN authentication in a device template, alongside VSPA and external IdP options for the same gateway.
More on Versa IdP
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages for the Titan Portal and SASE platform that Versa IdP authenticates users into. | How the Secure SD-WAN and SASE services Versa IdP protects are packaged and delivered, from the vendor. | Versa’s training portal: courses and labs covering identity, security policy, and portal administration. |
Related terms
If you’re reading about Versa IdP, these are worth looking at next.
| Titan Portal | Identity Provider | SASE Gateway |
|---|---|---|
| The cloud dashboard where Versa IdP accounts are created, managed, and assigned roles and privileges. | The general concept Versa IdP is one implementation of, alongside external IdPs such as Okta or ADFS. | The gateway type that can authenticate remote users against Versa IdP, an external IdP, or VSPA locally. |