Single Sign-On (SSO) is an authentication method that lets your users sign in to 8x8 applications with the same credentials they already use across your organization, instead of a separate 8x8 username and password. After signing in once through your organization's identity provider, users can open their authorized 8x8 applications without entering their credentials again.
8x8 supports SSO through the Security Assertion Markup Language (SAML) 2.0 standard so you can connect any SAML-compliant identity provider. 8x8 also provides guided setup for common providers, including Google, Microsoft Azure (Entra), and Okta.
An identity provider (IdP) is the system that stores your users' identities and verifies who they are at sign-in. When a user signs in to an 8x8 application, 8x8 redirects the request to your identity provider. The identity provider confirms the user's identity and returns the user to 8x8 already authenticated. Your identity provider securely handles and stores all user credentials; 8x8 never retains them.
In this relationship, your identity provider verifies users, and 8x8 is the service provider that grants access once they are verified.
Features
Centralized credentials: User credentials are stored and managed entirely in your identity provider, not in 8x8.
Simplified access: Users sign in with the corporate identity they already use, with no separate 8x8 username and password to remember.
Faster sign-in: After authenticating once, users move between authorized 8x8 applications without signing in again.
Flexible provider support: Connect any SAML 2.0 identity provider, with guided setup for Google, Microsoft Azure (Entra), and Okta.
Multiple providers: Configure more than one identity provider on a single account to support mergers, divisions, or mixed environments.
Identity Mapping
For SSO to work, every sign-in from your identity provider must resolve to exactly one 8x8 user account. 8x8 does this by matching on a Federation ID.
The Federation ID defaults to the user's 8x8 username, typically corresponding to their email address. When the username your identity provider provides matches the 8x8 username, no further configuration is needed.
If you do not want to match on the 8x8 username, populate the dedicated Federation ID field on each user record with the exact identifier your identity provider sends. 8x8 then matches on that value instead. Use this field when your 8x8 usernames are not the same as the identifiers in your identity provider.
Note:
The identifier must match exactly; even a small difference, such as an extra space, prevents the user from being matched. The Federation ID must also be unique. It cannot be assigned to more than one 8x8 user.
Configure Federation ID or Google ID in user records
For Google SSO, the equivalent field is the Google ID. To set these values on user records, see Configure Federation ID or Google ID in user records.
Set up SSO
As an administrator, you set up SSO in two steps:
Step 1: Set up 8x8 in your identity provider
In your identity provider, add 8x8 as a Security Assertion Markup Language (SAML) application and gather the values 8x8 needs, such as the sign-in URL, issuer, and signing certificate. The exact steps differ by provider. See the page for your provider for details.
Note:
Typically, this step is completed by your IT or security team.
Step2: Add the provider in 8x8 Admin Console
Sign in to 8×8 Admin Console
Go to Home > Identity and Security.
Enable Single Sign-On (SSO).
Click + Add SSO.
In the Add a new Single Sign-On (SSO) integration window, choose your authentication method or identity provider.
Finish configuration based on your provider:
Google SS. To learn more, see Set up Google SSO for 8x8 Admin Console.
Microsoft Azure (Entra) SSO. To learn more, see Set up Microsoft Azure (Entra) SSO for 8x8 Admin Console.
Okta SSO. To learn more, see Set up Okta SSO for 8x8 Admin Console.
Other SAML provider. To learn more, see Set up another SAML SSO provider for 8x8 Admin Console.
mTLS authentication. To learn more, see Set up mTLS Authentication for 8x8 Admin Console.
You can add more than one identity provider to a single account. See Set up Multiple Single Sign-On.
Choose how users sign in
When you enable Single Sign-On (SSO), you choose whether users can still use their 8x8 credentials:
8x8 Authentication and Single Sign-On both enabled: Users can sign in with either their 8x8 credentials or your identity provider.
Single Sign-On only: Users must sign in through your identity provider and cannot use their 8x8 credentials.
Note:
When SSO only is enabled, all administrators keep their 8x8 authentication as a backup, regardless of this setting. This prevents administrators from being locked out if the identity provider is unreachable.
Automate user management with User Provisioning Integration (SCIM)
After you configure SSO, you can enable User Provisioning Integration (SCIM) to automatically create, update, and deactivate 8x8 users from your identity provider, instead of managing them manually. For setup steps, see Set up User Provisioning Integration.
To learn more, see:
Configure your identity provider
Manage users and sign-in
Multiple providers