KunjaeSecurity

SSO certificates, rotated and verified before anything breaks.

Kunjae runs as a scheduled job inside your own Azure tenant. It rotates the SSO signing certificates in Entra ID and on every app that trusts them, then validates the sign‑in before it calls the rotation done.

For Microsoft Entra ID, with connectors for Slack, Datadog, PagerDuty, Notion, Salesforce and Okta.

Talk to usHow it works
Scheduled run · 02:00 · Sample

02:00:07slack · step 05/09create certificate in Entra ID

Creating the new signing certificate.

An expired signing certificate is an SSO outage on a date you already knew

Declare your apps in one YAML file, and Kunjae rotates them one by one as each reaches your rotation threshold. By hand, rotation rests on a reminder and one person’s memory.

Every run proves the sign-in, then tells you.

run log · slack · sample
02:00:0101acquire Entra ID tokenok
02:00:0202cache session, read current signing stateok
02:00:0403authenticateok
02:00:0504verify sessionok
02:00:0705create certificate in Entra IDok
02:00:0906activate certificate in Entra IDok
02:00:1107verify certificate is active in Entra IDok
02:00:1908save certificate, validate SSOvalidated
02:00:1909delete local certificateok

Set up once

Kunjae reads one plain file that you keep in version control. Deploy the Azure resources with the Bicep templates, then fill it in.

  1. Declare your appsOne entry per connector.
  2. Point secrets at Key VaultEach ${...} resolves at runtime and never lands in the file.
  3. Set your thresholdsWhen to rotate, and when to warn.
config.yaml
1platforms:2  - name: slack3    driver: slack_v14    credentials:5      username: ${SLACK_USERNAME}6      password: ${SLACK_PASSWORD}7  - name: datadog8    driver: datadog_v19    credentials:10      api_key: ${DATADOG_API_KEY}11 12rotation:13  trigger_days: 6014  warn_days: 14

Self-hosted, with no vendor in the data path

Your Azure tenant. Inside it, Kunjae, a scheduled job with no listening port, reads secrets from Key Vault and creates, activates, and verifies credentials in Microsoft Entra ID. At runtime it reaches outside the tenant only to upload, verify, and validate on your apps, and to email your team through Graph or SMTP. The container image is pulled from Kunjae Security's registry at deploy time only.Kunjae SecurityContainer registryImage pull atdeploy time onlyYour Azure tenantKey VaultSecrets resolved at runtimesecretsKunjaeScheduled job, no listening portcredentialMicrosoft Entra IDCreate, activate, verifyupload, verify,validateYour appsSlack, Datadog, PagerDuty,Notion, Salesforce, OktaemailYour teamRotation emails and warnings,via Graph or SMTP Your Azure tenant, drawn vertically. The container image is pulled from Kunjae Security's registry at deploy time only. Inside the tenant, Kunjae reads secrets from Key Vault and manages credentials in Microsoft Entra ID. It reaches outside the tenant at runtime only to upload, verify, and validate on your apps, and to email your team through Graph or SMTP.Kunjae SecurityContainer registryImage pull at deploy time onlyYour Azure tenantKey VaultSecrets resolved at runtimesecretsKunjaeScheduled job, no listening portcredentialMicrosoft Entra IDCreate, activate, verifyupload, verify,validateYour appsSlack, Datadog, PagerDuty, Notion,Salesforce, OktaemailYour teamRotation emails and warnings, via Graph or SMTP

For your security review

We store none of your data, so your team reviews the software, not a vendor service.

Architecture and design documents
In-depth documents on what runs where and how each rotation works.
Test it in your environment
Your security team can test the software inside your own tenant.
Signed container images
Pulled from our authenticated registry at deploy time, with a software bill of materials.
License checked locally
The license is a signed key verified inside your tenant.

Six connectors built

Slack
Datadog
PagerDuty
Notion
Salesforce
Okta

See all connectors

Start free with Community Edition

Community Edition is free. Paid editions add connectors and support. Pricing announced before general availability.

Community Edition

Pending release

Free

  • Up to 5 connectors per Microsoft Entra tenant
  • Slack, Datadog and PagerDuty
  • Two more connectors, to be chosen by community vote

Business

Q1 2027

Price announced before release

  • Up to 20 connectors
  • Email support

Enterprise

Q2 2027

Contact us

  • More than 20 connectors
  • Priority support, planned

Each app entry in your configuration counts as one connector.

Retire the expiry reminder

Questions about editions, connectors or your security review? We’ll answer them directly.

Talk to us