You can restrict access to your media by using SSO locking. To access this funcionality go to Settings → Security → Single Sign-on

To turn on Single Sign-on locking make sure you already configured Azure AD or SAML2 in your console. Read more about configuring Azure AD in this article.

Note that restricting media using SSO will lock all video embeds - if you will configure it on account level it will lock all media. If you will configure on the specific media it will lock all embeds of this media. 

Restricting access without specifying permitted groups will cause locking the media from access to users authenticated against your user domain. In that case any authenticated user regardless of group membership will be permitted to view the media. 

You can check your current groups on Azure AD Portal in Groups tab.

In here you can check or modify your existing groups or add some new.

For SAML2 all groups in a SAML2 Assertion are always automatically added to the list of groups in Console. 

For Azure AD you will be provided only with groups that have a Quickchannel role assigned to them. All those group will be visible on the list in Console and they can be used to control access. If you wish to use group membership to restrict media playback you must also add the Viewer role to these groups. The Viewer role is used to specifically mark the additional groups that you want to see and use without giving those users access to log in to Console.

New groups will appear in here after a member of some group successfuly logged in to the console.

After submitting, access to the media will be granted after validating credentials to your account that is member of groups specified as permitted.