Learn about the process of migrating your tenants to Single Sign-On (SSO).

1. Review SSO configuration
   Review the existing configuration, to help decide whether you will enable SSO for each tenant separately or apply a unified SSO configuration across all tenants.

   • From the UI, review the SSO Configuration at a glance for each of your tenants. If SSO is not enabled, you will be prompted to configure it.
   • From the API, you can see everything with one request to the Get Customer API and review the configuration under the externalProviderConfig attribute. If externalProviderConfig is empty, you don't have SSO on any of your tenants. If you have configured SSO separately on each tenant, you will see different configurations under externalProviderConfig, one for each SSO tenant. The subattribute "tenants" contain the tenant ID for that specific SSO configuration. All your tenants should be under the "tenants" subattribute. If you have more than one SSO config, all your tenants should be distributed among these configurations under the "tenants" subattribute. Identify all your tenants that are NOT listed under externalProviderConfig.
2. Enable SSO for tenants
   Our platform supports two authentication protocols, Security Assertion Markup Language (SAML) and OpenID Connect (OIDC). We provide overviews and configuration instructions for SAML and OIDC, including Identity Providers (IdP), and you may also want to consult with your security team to determine the protocol for your tenants.

   • Security Assertion Markup Language (SAML) Single Sign On (SSO)

     • SSO Configuration Based on SAML

     • SAML IdP Configuration

     • Security Assertion Markup Language 2.0 Configuration - FAQ

   • OAuth 2.0/OpenID Connect (OIDC) Single Sign On (SSO)

     • SSO Configuration Based on OIDC

     • Set up an IdP for OAuth/OIDC with sample configuration for different Identity and Access Management (IAM) solutions, for example Okta, Google, and Azure.

     • OAuth 2.0/OIDC authentication flow

     • OpenID Connect configuration - FAQ

3. Apply a unified SSO configuration across all tenants
   If you decide to apply a unified SSO configuration across all tenants, manually configure the first one as described above. Then apply the same configuration to the other tenants, for more details see topic Update Tenant SSO configuration.
4. Verify enforcement of SSO Login Page
   Check the login page for each tenant is updated to enforce SSO, providing a consistent and secure login experience. For more details, see topic Verify SSO configuration.