What are the Standard and Sovereign profiles?

The service runs in one of two profiles, chosen when it is installed: Standard or Sovereign. Almost every organization uses Standard, and this knowledge base describes Standard unless an article says otherwise.

What is the difference?

What does Standard offer that Sovereign does not?

The features built for common applications and everyday users, such as phone approval with the approver app (including sign-in with the phone alone), SAML and Microsoft 365 sign-in, single sign-on with common OpenID Connect applications, and email account recovery. Your provider can tell you exactly which features a Sovereign installation offers.

Is Standard post-quantum?

Partly, and the service does not call it "post-quantum". The connection between the browser and the service uses a hybrid post-quantum key exchange when the browser supports it, and receipts and licences are also signed with a post-quantum algorithm (ML-DSA-65). Passkeys, server certificates and some connections still use classical cryptography. See post-quantum cryptography.

Is Sovereign available?

Only on request. The Sovereign code exists, but it depends on Android hardware that has not yet been qualified for any phone model, and the installation evidence is still being completed. Availability is agreed case by case.

How do I know which profile I use?

The profile is set at installation and no console option changes it. If your console shows «My phones», «Single sign-on» or «SAML applications», you are on Standard. If in doubt, ask your provider.