All training
Learning plans, paths, courses, hands-on labs and instructor-led training.
Identity security fundamentals
Learn the core ideas behind identity security: identities, credentials, authentication, authorization, IAM, PAM, IGA and Zero Trust.
Monofor Foundations
Start here. Learn the core ideas of identity security, take a guided tour of Monosign, Monopam and Monosync, and set up your first Monosign tenant in a hands-on lab. Prepares you for the Monofor Certified Associate exam.
Getting started with Monosign
Tour the Monosign platform, connect your first directory and put your first application behind single sign-on and MFA. Written for release v2026.10.
Lab: Set up your first Monosign tenant
Your own Monosign v2026.10 server, empty and ready. Import an employee list, create a group, connect a SAML application, give the pilot users access and require a second factor for them.
Monosign directories and user sources
Connect Active Directory and LDAP directories as user sources, run them safely day to day, reach closed networks with the Source Agent and serve Monosign identities to LDAP-only systems. Written for release v2026.10.
Monosign administrator learning plan
Master directories, federation, MFA and conditional access, lifecycle automation, and audit and reporting, practise in hands-on labs and prove your skills in the badge assessment.
Monosign SSO and federation
Configure SAML 2.0 and OIDC applications, map claims, trust external identity providers and troubleshoot federation from real log messages. Written for release v2026.10.
Monosign MFA: design, rollout and troubleshooting
Everything a partner needs to deliver multi-factor authentication with Monosign: the authenticator catalog, Monofor Identity push, user enrollment, code delivery, VPN and Windows logon, approval-gated sign-in and a troubleshooting playbook. Written for release v2026.10.
Lab: Roll out MFA for a customer tenant
Your own Monosign v2026.10 server with a lab mail server and SMS gateway. Connect the channels, enable e-mail and SMS codes, set the order users see, enroll a user, sign in with MFA and lock the MFA state.
Monosign lifecycle automation
Automate joiner, mover and leaver processes from your HR source to downstream applications with automation rules, triggers and provisioning connectors. Written for release v2026.10.
Lab: Debug a broken federation
Your own Monosign v2026.10 server with a SAML application and a partner identity provider that both fail for real. Read the errors and the audit log, fix each fault in Monosign and prove the fix with a real sign-in.
Lab: Solve five MFA support tickets
A customer tenant with MFA already in place and five open tickets. Each ticket hides a real misconfiguration. Find the cause from the symptoms and the logs, fix it and prove the fix.
Monosign audit, reporting and troubleshooting
Answer an auditor's questions with the audit log, Access Timeline and Report Studio, and find out why something failed with sessions, provisioning records, logs, traces and diagnostics. Written for release v2026.10.
Lab: Build conditional access policies
Your own Monosign v2026.10 server with staff, administrators, users at risk and an emergency account. Build a layered policy set and watch real sign-ins from different countries and networks get denied, challenged or allowed.
Badge assessment: Monosign administration
A 30-minute scenario-based assessment on federation, MFA and conditional access, and lifecycle automation. Pass it to earn the Monosign Practitioner badge.
Lab: Investigate a compromised account
Ticket INC-4821 at Aldermoor Freight: Nora Lindqvist in accounts payable can no longer sign in, and she is suddenly a member of Finance Approvers, the group that may release payments. Nobody in Finance asked for that. On your own Monosign server you find out who did what from the audit log, contain the account, show from the Access Timeline when the access existed, and send the evidence to the auditor as a scheduled report.
Monosign administration (3 days, instructor-led)
Three instructor-led days on directories, SSO and federation, MFA and conditional access, lifecycle automation and threat response, with guided labs in your own training tenant.
Lab: Connect and repair directory sources
Your own Monosign v2026.10 server next to a real LDAP directory server. Connect one directory as a user source and run its first sync, repair a second source that never synced and brings too few people, and clean up a username that now exists twice.
AI security professional learning plan
Govern AI agents as non-human identities, put models, MCP tools and agent-to-agent calls behind the Monosign gateways, add guardrails, spend control and evidence, give agents short-lived credentials in Monopam, and practise in the MCP gateway lab.
AI agent security path
Learn how to treat AI agents as governed identities, then apply it hands-on by putting an MCP server behind the Monosign MCP gateway.
AI security fundamentals
A short, non-technical introduction for decision makers and newcomers: why an AI agent is an identity, what can go wrong, which three families of controls answer the risks, and what regulation expects. Prepares for the free Monofor Certified AI Security Associate exam.
Securing AI agents with Monosign
Give every AI agent an owned identity, control delegation with on-behalf-of tokens, govern MCP tool calls through the gateway and keep humans in the loop. Written for release v2026.10.
Lab: First steps in AI security
Your own Monosign server and a small lab client that plays an AI agent. Register the agent with an accountable owner, give it one permission, cap it with a request budget and watch Monosign throttle and then suspend it. Then look at the AI apps employees open in their browsers and decide which are sanctioned, tolerated or unsanctioned.
Identity threat detection and response with Monosign
Detect identity attacks at sign-in and session level, run incidents and playbooks, exchange signals over SSF and CAEP and track posture with the security score. Written for release v2026.10.
Lab: Govern AI agents in the MCP catalog
Register an AI agent with an owner, add an MCP server to the catalog, allow only the tools it needs, decide approvals for a destructive tool and stop the agent with the kill switch. The MCP gateway service is a separate component that this lab does not install, so a small lab client, ticket-agent, reads the same catalog and approvals in its place.
Lab: Human approval for AI agents
Your own Monosign server and a small lab client that plays an AI agent paying refunds. The agent never pays on its own: it asks Monosign for approval and waits. You decide who is asked, how many people must approve, how long a request waits and whether a reason is required, then approve, let a request expire, approve as a second person from an e-mail link and deny, and read in the audit trail who decided.
Identity threat detection path
Build the skills to detect, investigate and contain identity attacks with Monosign ITDR, shared signals and the security score.
Lab: AI flows, from watching to enforcing
Your own Monosign server, three employees and a small lab client that plays their AI chat app. Build a flow that stops secrets from leaving in a prompt, run it in watching mode first and read what it would have blocked, then start enforcing and see the prompt stopped. Add a second flow that replaces personal data with placeholders, and extend the first one with your own keyword.
AI security with Monofor: gateways, guardrails and machine credentials
Build the full AI security stack: a threat model for agents, v2026.11 agent budgets and approvers, the AI, MCP and A2A gateways, AI flows, shadow AI and spend control, evidence for auditors, and short-lived machine credentials in Monopam. Written for Monosign v2026.11 and Monopam v2026.09.
Lab: Conditional access for AI agents
Your own Monosign server and a small lab client that plays an AI agent building a nightly report. The agent trades its credential for a short-lived access token, and Monosign decides at that moment whether it may have one. Limit the agent to certain hours and to a network, watch the token request being refused with the reason, read the refusals in the audit trail, and then set restrictions that let the agent work again.
Running Monofor as an MSP: the business model
For sales and management at managed service providers: the three ways to serve a customer, how the shared MSP licence works, what the products count and how to read usage per customer before you invoice. No prices, no configuration.
Multi-customer architecture for MSPs
For architects at service providers: how a request finds its tenant, what a dedicated database does and does not separate, how to spread tenants over several app servers, and when a customer should run its own installation as a remote tenant.
Day-to-day MSP operations with Monopam
For the operations team of a service provider: open a customer tenant and follow its preparation, give your staff access to it with a role, policies and an end date, handle access requests, take access away, and plan for what the product does not do.
Delivering managed service with privileged access
For the people who do the work in customer tenants and those who answer for it: which role fits which job, how to use your own accounts at a customer without handing over the password, what evidence both sides get, and which controls stay with the customer.
Running Monofor as an MSP
The learning path for managed service providers: the business model first, then the multi-customer architecture, day-to-day operations and delivering the service with privileged access and evidence. The first course is free.
Badge assessment: Monopam administration
A 30 minute scenario-based assessment on vaulting and rotation, session recording and monitoring, and just-in-time access. Pass it to earn the Monopam Practitioner badge.
Certification prep workshop
A live, instructor-led session for candidates preparing for MCSA, MCPA or MCIP. Walk through the exam blueprints domain by domain, work through sample scenario questions, and get practical tips on performance tasks and time management.
Monopam administration (3 days, instructor-led)
Three instructor-led days with hands-on labs covering gateways and agents, vaulting and rotation, session recording and monitoring, and just-in-time access with approvals. Includes preparation for the MCPA exam.
Events, webhooks and observability for integrations
Test and operate Monosign webhooks, work the Dead Letters list, choose the right health probe, read the logs each component really offers, and watch Monosync integrations with its health answer, logs, monitors and audits.
Lab: Just-in-time access with approval and revoke
A real Monopam with a Linux server and a user who can reach it at any time. Remove that standing access, offer the server through a Request Policy, then request, approve, use and revoke time-bound access while the server itself proves each step.
Lab: Record and review a privileged session
A real Monopam and a Linux server, with recording switched off for the whole tenant. Turn it on, grant access through a policy that denies a risky command, run an SSH session and review its recording with a shared note.
Lab: SCIM provisioning and webhooks
Push accounts from your own lab tenant to a real SCIM 2.0 target: create the application and its key, send a pilot group, remove a user and watch the account go, schedule a sync and deliver a webhook.
Delivering Monofor implementations
For partner and MSP implementation teams: scope and size a Monosign, Monopam and Monosync project, plan and run the installation, roll out SSO and MFA in waves, and finish with acceptance testing and a clean handover. Written for release v2026.10.
Monopam architecture and installation
Plan a Monopam installation that survives production. Place sign-in and MFA at the identity provider, route sessions through gateways and sites, split tenants across app servers without doubling jobs, and run the agent fleet safely.
Monopam audit and compliance evidence
Answer an auditor from the product. Learn which record proves who connected, who approved, who saw a secret and what a machine or an AI assistant did, and which records age out or are not evidence at all.
Database and Kubernetes access through the Monopam gateway
Let people and applications use their native database clients, kubectl and oc while Monopam injects the real credential, evaluates every statement or API call and writes an audit record for each.
Getting started with Monopam
Learn how Monopam is built (vault, gateway and agents), add your first target system and open your first brokered, recorded privileged session.
Just-in-time access with Monopam
Replace standing privilege with time-bound grants. Publish a request catalog, route requests to approvers, revoke early when needed and shorten how long credentials live.
Monopam session management: protocols, recording and live monitoring
Broker privileged sessions through the gateway, make sure every session is recorded, review recordings with notes and step into live sessions when something looks wrong.
Monopam vault: discovery, vaulting and rotation
Find privileged accounts nobody onboarded on purpose, bring them into the vault and keep their passwords changing with rotation policies that do not break dependent systems.
Monosign management API, SCIM 2.0 and webhooks
Automate identity operations with the versioned Monosign REST API, push users and groups to applications with SCIM 2.0, and react to audit events with webhook receivers that tolerate retries. Written for release v2026.10.
Access reviews and separation of duties
Run Monosign access certification campaigns that finish, act on their results by hand, and build separation of duties rules with a clear view of what they do not cover.
Building integrations with Monosync
Choose the right built-in provider and know its limits, extend it with actions, functions and interceptors, and connect application entitlements through Monosign sources.
Getting started with Monosync
Understand what Monosync does, how providers and sources connect your systems, and how an integration maps data, links records and runs on a schedule.
Compliance with identity controls: GDPR, NIS2, DORA and KVKK
Translate regulatory obligations from GDPR, NIS2, DORA and KVKK into concrete identity controls such as access reviews, separation of duties and least privilege, and produce evidence an auditor can verify.
Integration developer learning plan
Build and operate integrations on the Monofor platform with Monosync connectors, the Monosign management API, SCIM 2.0 provisioning and webhooks, finishing with a hands-on SCIM lab.
Monopam administrator learning plan
The complete path to running Monopam in production, from architecture and installation through vaulting and rotation, recorded sessions, database and Kubernetes access and just-in-time access to audit evidence, with two hands-on labs and a badge assessment.