FedRAMP Onboarding Guide

Onboarding to Descope FedRAMP High runs from the first kickoff call to production go-live. This page lists the decisions to make before kickoff, the inputs Descope needs from you, and the steps that involve the FedRAMP hosting provider.

This page is for teams that have chosen Descope FedRAMP High and are preparing to onboard. For how the authorization, hosting, and encryption work, see FedRAMP High Authorization. For the administrative configuration guidance that FedRAMP requires, see the FedRAMP Security Admin Guide.

How Descope FedRAMP High Works

A FedRAMP environment is a separate deployment inside a government authorization boundary, and that boundary explains most of the onboarding steps on this page. Network access, certificates, and third-party integrations all need changes inside the boundary, and the hosting provider makes those changes. Each change goes through a formal request, so complete and accurate inputs keep these steps short.

Descope FedRAMP also has its own Console, projects, and endpoints, and a narrower feature set than commercial Descope. See Feature Availability in FedRAMP for details.

Onboarding Timeline

Plan for about one week to a staging environment you can build in, and six to eight weeks to full production. The timeline starts when Descope has your IP addresses and the email address of your first Console administrator. Sending those two inputs early has the largest effect on your timeline.

Decisions to Make Before Kickoff

Five answers shape your onboarding plan. Bring them to the kickoff call.

1. Target timeline: When do you need staging, and when do you need production?
2. Login experience: Will you embed Descope flows in your own app with the Descope SDK, or use Auth Hosting? FedRAMP supports both, and Descope confirms the right fit for your deployment at kickoff.
3. Authentication methods: Which methods will your users sign in with, for example passkeys, SSO, or passwords? Some methods are not available in FedRAMP, so check Feature Availability in FedRAMP first.
4. Identity providers and connectors: Which IdPs and third-party services must Descope reach? Each one must have a FedRAMP High government offering, as described in Identity Providers and Connectors.
5. Existing Descope environment: If you already use commercial Descope, will you migrate those projects or run FedRAMP in parallel? See Development Environments and Migration.

What You Need to Provide

Send these items with your kickoff confirmation. If an item is missing, the step that depends on it pauses until it arrives.

• Email of your first Console administrator: This person receives the first invitation and can invite others.
• Exact IP addresses for everything that connects into the environment: Include engineers' workstations or VPN exits, CI/CD runners, and any other system that calls into the environment. Send single addresses in /32 form. Descope cannot accept ranges.
• SSO metadata URL (XML): Send one for each SAML identity provider you plan to connect, so Descope can request network access to that host.
• Custom domain name: If you plan to use a custom domain for login and Console access, send the domain name.
• Signed TLS certificate: After Descope sends you the certificate signing request (CSR), return the signed certificate for your domain. See Custom Domain Setup.
• Connector details: For each third-party service, send the vendor's government-region endpoint and its FedRAMP High authorization.

Network Access and Allowlisting

The FedRAMP Console is open to US-based customers without a VPN or IP allowlisting. It only allows sign-in with Magic Link or SSO. If you sign in with SSO, Descope allowlists your IdP host so the sign-in can complete, and the Console stays open either way. Programmatic traffic is different: anything that calls into the environment from code or automation must come from an allowlisted address.

To add or change an address later, send the new /32 address to your Descope contact.

If your firewall restricts inbound traffic from Descope, for example to your SAML IdP or a webhook endpoint, allowlist the FedRAMP static IPs.

Custom Domain Setup

A custom domain is optional and takes two to three weeks from start to finish. Three parties take part: you, Descope, and the FedRAMP hosting provider. You act three times, and Descope handles every exchange with the hosting provider, so you never contact the hosting provider directly.

1. You choose the domain you want for login and Console access, and send it to Descope.
2. Descope requests a CSR from the hosting provider.
3. The hosting provider generates the private key and the CSR.
4. Descope sends the CSR to you.
5. You buy a certificate that meets the certificate requirements using the CSR, and return the signed certificate to Descope.
6. Descope submits the certificate to the hosting provider through the formal request channel.
7. The hosting provider installs the certificate and issues three IP addresses for your domain.
8. You point DNS A records for your domain to the three IP addresses.

The hosting provider generates the private key together with the CSR, so the private key never leaves the FedRAMP environment. You only handle the CSR and the signed certificate.

Certificate Requirements

The certificate you buy in step 5 must meet these requirements:

• Type: The certificate must be a Basic Organization Validated (OV) certificate.
• Issuer: A publicly trusted certificate authority must issue the certificate. DigiCert is a common choice.
• Validity: The certificate must be valid for one year. Short-lived certificates, such as those from Let's Encrypt or Google, are not accepted.

Allow about five business days on the Descope side after you return the signed certificate, plus your certificate authority's own turnaround.

Which Endpoint to Use Where

A FedRAMP environment has two kinds of endpoints. Your custom domain serves user-facing login and Console access. Every Management API call goes to https://descope.fedstart.com, even when you have a custom domain.

When you initialize the Descope SDK, set the base URL explicitly. The commercial default endpoints do not reach your FedRAMP environment. Private Cloud Deployments shows how to set the base URL in the SDK.

Feature Availability in FedRAMP

Core authentication is available in FedRAMP, including passkeys, SSO through government IdPs, embedded flows, and Auth Hosting. Features that depend on commercial third-party services are not available, unless that service has its own FedRAMP High offering.

Availability changes as services gain FedRAMP authorization. Confirm the current status with your Descope contact before you design around a feature.

Identity Providers and Connectors

Any IdP or third-party service that Descope connects to must hold its own FedRAMP High authorization. In practice, that almost always means the vendor's government offering, not its commercial endpoint.

Identity Providers

Federated Identity Providers lists the government offering to use for each common IdP, and which consumer and social logins are out of scope. JumpCloud, ClassLink, miniOrange, and LastPass do not hold FedRAMP High authorization, so you cannot use them.

For SAML SSO, send Descope your IdP's metadata URL. Descope requests network access to that host, and then you configure SSO the same way as in commercial Descope.

Connectors

In FedRAMP, connectors run through the Descope Engine, a container you run in your own network. The Engine Quick Start covers creating the Engine in your FedRAMP Console and deploying it.

The current connector template is HTTP. Each connector's destination must be a FedRAMP High endpoint, for example AWS GovCloud, Salesforce Government Cloud Plus, GovSlack, or Google Assured Workloads. Ask your Descope contact for the current Approved Connectors and Approved OAuth Vendors lists.

Development Environments and Migration

Build your development, staging, and production projects inside FedRAMP. Projects built in commercial Descope may not import cleanly, for the reasons below.

• Version differences: FedRAMP runs a slightly different release than commercial Descope. A project snapshot exported from commercial Descope can contain fields or settings that FedRAMP doesn't support yet, which can break a Terraform apply.
• Connector mismatch: Connectors you add in a commercial project may not be available in FedRAMP. Designing in FedRAMP from the start avoids rework.
• Migrating existing projects: If you already run commercial Descope, Descope can help you export projects and import them into FedRAMP. Expect a review pass for unsupported features before cutover.
• Running both: If you also need non-US data residency, keep a separate commercial environment for those workloads, because FedRAMP instances are US-only.
• Terraform: Terraform works the same way as in commercial Descope, using the Management API endpoint above.

Support and Next Steps

Your next step is to send the items in What You Need to Provide to your Descope contact. Descope schedules kickoff as soon as the items arrive.

• Service status: Check fedramp.descopestatus.com.
• Onboarding and implementation questions: Contact your Descope Customer Success contact.
• Security and compliance questions: Email security@descope.com.
• Compliance documentation: On request, Descope provides the Descope FedRAMP Customer Responsibility Guide (CRG), which lists the controls you own in a Descope FedRAMP deployment, plus the SSDF attestation and the OIDC IdP FedRAMP High readiness list. The full PFCS-SS authorization package is available to agencies through the FedRAMP Marketplace package request process. It includes Palantir's Customer Responsibility Matrix.