# Endpoint user

An endpoint user is a person who enrolls their own device in a Managed Nebula network by signing in with your organization's identity provider, instead of using an [enrollment code](/docs/glossary/enrollment-code/). This is called endpoint SSO. Endpoint users aren't admins. Endpoint SSO only connects their devices, and SSO for signing in to the [admin panel](/docs/glossary/admin-panel/) is set up separately.

To set it up, add an endpoint OIDC provider on the [Single sign-on](https://admin.defined.net/settings/sso) settings page and verify your email domain with a DNS record. The provider decides which [network](/docs/glossary/network/) and [role](/docs/glossary/role/) its users' devices get, and its **Authentication validity**, which is how long a device keeps network access after its user signs in. The default is 16 hours, enough for a workday. After that, the user signs in again to renew access.

A person becomes an endpoint user the first time they sign in from [DNClient Desktop](/docs/glossary/dnclient-desktop/) by choosing **Join network** and then **Authenticate with email**. Each device they enroll becomes its own [host](/docs/glossary/host/), with a name that includes their email address. The [Users](https://admin.defined.net/users) page in the admin panel lists every endpoint user with their email, provider, and hosts. A person is removed from it when their last host is deleted.

Disabling an endpoint OIDC provider stops new sign-ins, but devices that are already signed in keep their access until it expires. To cut off a lost or stolen device right away, [block its host](/docs/guides/blocking-and-unblocking-hosts/). Endpoint users' sign-ins appear in the [audit log](/docs/glossary/audit-log/) with the user as the actor.

For the full setup, including your identity provider's side, see [Setting up SSO](/docs/guides/setting-up-sso/). Endpoint OIDC providers can also be managed with an [API key](/docs/glossary/api-key/) that has the [`endpoint-oidc-providers` scopes](/docs/api-key-scopes/#endpoint-oidc-providers).