Single Sign-On Overview

  • Updated

Single Sign-On (SSO) lets your team log into Act-On the same way they log into everything else - through your identity provider, with one click, instead of a separate Act-On username and password. Act-On supports this through SAML (Security Assertion Markup Language). If a user belongs to multiple Act-On accounts, they'll see a screen listing each one with an option to sign in.

Why this matters: One login to manage means one place to enforce your password policy, MFA, and offboarding. When someone leaves the company, disabling their identity provider account is enough - you don't have to remember a separate Act-On credential too.

Quick Reference (Advanced Users)

  • SAML isn't on by default - contact Support to enable it.
  • Send Support your IDP metadata (XML, with an Entity ID) and a signing certificate (TXT); Act-On sends back SP metadata with our Entity ID.
  • Sessions refresh every 2 hours. Azure users need session management configured, since Azure doesn't refresh automatically.
  • SSO users can't view/reset their Act-On password, use the Act-On Anywhere plugin, or authenticate to the API (including tools like Zapier). Use a dedicated non-SSO user for API access instead.

Please note: SAML is not enabled by default. You can contact Support for more information about enabling it. If you are using Azure there are some additional steps required to configure a SAML Identity Provider before setup.

How to Setup SSO

Please consider the restrictions listed in the Limitations section below before requesting this feature.

If you are ready to start the process, please send Support the following:

  • Your Identity Provider (IDP) metadata (XML file). This must include an Entity ID.
  • A Signature signing certificate (TXT file)

We will then send back our SAML Service Provider (SP) metadata (XML file). This will include our Entity ID, which can vary depending on your region. Once this data has been exchanged, we can deploy the configuration changes to our SAML server.

Finally, we arrange a date and time to 'switch on' the feature and provide the last instructions on how to register the SSO users within the Act-On platform.

Act-On SAML service has a 2-hour refresh requirement, so users will need to refresh their IDP session. Most IDPs do this automatically; however, Azure does not, and it requires session management to be set up.

Limitations

There are a few restrictions to using this setup

  • You cannot view/reset/change your Act-On password through the platform
  • You cannot use the Act-On Anywhere plugin with SSO users.
  • You cannot authenticate to the API with SSO users.
    • This includes using external tools that use the API such as Zapier.

If API access is needed, we can set up a non-SSO user that can be dedicated to those integrations.

Related to

Was this article helpful?

Have more questions? Submit a request