Set up mTLS Authentication for 8x8 Admin Console

Mutual Transport Layer Security (mTLS) is a certificate-based, passwordless authentication method for Android devices. Instead of a username and password, each device authenticates with a certificate, which suits shared and managed devices in frontline environments.

Note:

Review the following requirements and constraints before beginning configuration.

• Android exclusive: This feature is restricted to Android devices.

• Secondary SSO requirement: mTLS cannot serve as your sole authentication method. Because it only supports Android devices, you must maintain at least one additional identity provider for standard user accounts.

• Single Integration Limit: You can set up only one mTLS provider per 8x8 account.

• Multi-SSO requirement: mTLS authentication is available only to customers with multiple Single Sign-On configured on their account.

How mTLS authentication works

• IT deploys a device certificate using a supported Mobile Device Management (MDM) platform.

• The device authenticates automatically with its certificate, with no login screen.

• The device receives secure tokens to access 8x8 applications.

• If a device is lost or stolen, IT can revoke its certificate immediately.

Each certificate is mapped to a specific user and is validated against your organization's Certificate Authority (CA).

Prerequisites

Ensure your environment meets these requirements before enabling mTLS authentication:

• 8x8 Work for Managed Devices version 12.6.1 or later

• 8x8 Admin Console version 1.57.2 or later

• An MDM platform  that supports certificate deployment

• An internal or third-party CA

• IT capability to create and manage certificate profiles

Add mTLS authentication in 8x8 Admin Console

Certificate distribution must be configured within your MDM platform directly. Consult your MDM vendor documentation for those deployment steps. The steps below cover the 8x8 side of setup only.

1. Sign in to 8x8 Admin Console.

2. Go to Home > Identity and Security.

3. Enable Single Sign-On (SSO).

4. Click + Add SSO.

5. In the Add a new Single Sign-On (SSO) integration window:

6. Select mTLS Authentication as your identity provider.

7. Under Label your provider, provide a distinct descriptive name for this provider. This label identifies the provider when admins assign it to users, so clear names prevent confusion.

8. Under mTLS Authentication settings, upload the root CA file in .cert, .cer, or .crt format. The certificate must contain the public key used to verify sign-in requests.

9. Copy the Customer ID for your MDM configuration. It is used to match device certificates.

10. Click Add.

11. Click Save on the Identity and Security page.

Note:

You can configure only one mTLS provider per account.

To learn more about mTLS authentication for Android devices, see About 8x8 Work Managed Devices for Android: Mutual Transport Layer Security (mTLS) authentication for Android devices.