> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/getting-started/console-access-and-login.md).

# Console Access & Login

How to access the Herd console: your organization ID, login options, and credentials.

## Overview

Herd Security is managed through a cloud-based admin console that is provided to each individual organization. This is the hub of creating content, building workflows, setting up integrations, sending trainings & simulations, and tracking the results. To ensure that every piece of content sent is actively changing security behavior across your users.

{% hint style="info" %}
Looking for organization-wide configuration (integrations, API keys, admin notifications, business hours, MFA)? See the [Settings](/herd-security-docs/settings/settings.md) section. Threat-intel feed sources are managed from the [Threat Feed](/herd-security-docs/settings/settings/threat-intel-feeds.md) page, and monitoring views are in [Reports → Activity](/herd-security-docs/reports/reports/activity-and-monitoring.md).
{% endhint %}

## Console Access & Credentials

***

Every customer will gain initial access to the Herd console directly from a member of the Herd Security team. You have two options for your credentials, username & password or Okta Single-Sign-On. In either case you'll be provided an organization ID to begin the login process.

### Organization ID

Your OrgID is a unique identifier for your organization. Use this anytime you log in to Herd. You'll receive this from your customer support manager during the onboarding process. From your login URL, you'll be directed to the following screen.

\**Note that Organization ID's are case sensitive.*

The login page starts on the Organization ID field, pre-filled with the last one you used. **Sign in with your email address** below it finds your organization from your email's domain instead. That works only once Herd has your organization's email domains on record; otherwise Herd says "We couldn't match that email address to an organization. Enter your organization id to continue." Ask Herd support to add your domains.

<figure><img src="https://2286452423-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrNdsHrfHsFuaMzCbOD5q%2Fuploads%2F4ObMqzEaDk5QbdVXmZdR%2FScreenshot%202025-08-20%20at%2009.50.55.png?alt=media&amp;token=deb7b4cd-4384-43a5-a449-71e4c6116bd4" alt=""><figcaption></figcaption></figure>

### Email & Password Login With AWS Cognito

If you selected to setup your console with AWS Cognito, you'll receive a welcome email to setup your login credentials. Once setup, you'll use your credentials to login in to Herd via the follow page.

<div data-full-width="false"><figure><img src="https://2286452423-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrNdsHrfHsFuaMzCbOD5q%2Fuploads%2F51USLvK7oPYPD2sYQ1DS%2FScreenshot%202025-08-20%20at%2010.00.08.png?alt=media&amp;token=b3c089a2-c33f-4bb8-bdd8-1fbf41585351" alt=""><figcaption></figcaption></figure></div>

#### Forgot your password?

If your organization signs in with email and password, the sign-in form includes a **Forgot password?** link next to the Password field:

1. Enter the email address you sign in with and click **Send reset code**. Herd emails you a **6-digit code** (valid for one hour — check spam if it doesn't arrive within a minute or two).
2. Enter the code with your new password (at least 8 characters, with an uppercase and lowercase letter, a number, and a special character), then click **Reset password**.
3. Sign in with the new password. If your organization requires MFA, you'll be asked for your authenticator code as usual.

{% hint style="info" %}
If you were invited recently and have never signed in, there's no password to reset yet — ask an administrator to resend your invite and set your password from that email. Organizations that sign in through SSO manage passwords in their identity provider instead, so the link doesn't appear for them.
{% endhint %}

### Okta Single-Sign-On (SSO)

By using Okta SSO, for login, you can use your preexisting Okta credentials to login to Herd. An administrator with the **Manage permissions** permission can set it up from **Settings → General → Access → Sign-in** without contacting Herd, in four steps and with a test sign-in on themselves first; see the [Okta SSO setup guide](/herd-security-docs/okta/okta-single-sign-on.md). A few organizations have sign-in that Herd manages directly, and Herd points those to support instead. The same card sets up [Microsoft Entra ID](/herd-security-docs/microsoft-entra-id-azure-ad/connect-microsoft-entra-id-sso.md), [Google Workspace](/herd-security-docs/google-workspace/connect-google-workspace-sso.md) and any [SAML 2.0](/herd-security-docs/saml-2.0/connect-saml-2-0-sso.md) identity provider.

Signing in through Okta is also how someone first appears in Herd. Whether that first web sign-in makes them an **Operator** (with your default group's permissions, as long as your plan has an [operator seat](/herd-security-docs/how-to-documentation/managing-roles-groups-and-permissions.md#operator-seats) free) or a learner is your organization's [app-access policy](/herd-security-docs/users/users/app-access.md): an admin's invite, or the role or group Okta sends, makes an Operator, and under the original **Everyone who signs in** policy a sign-in alone does. Out of the box the default group is **Full Access**, which makes every new Operator a full admin, so give the Okta application only to people who should be admins unless your policy keeps everyone else a learner. Bring everyone else in through [directory sync](/herd-security-docs/okta/okta-group-and-app-sync.md). A learner who signs in lands on **Your training**, a page with only their own trainings.

{% hint style="info" %}
SSO sign-in from the Herd login page uses PKCE (S256) automatically. Your organization is always identified from the identity provider that issued your login, never from anything the browser sends, so a login for one organization can never be used to reach another.
{% endhint %}