{ "doc": { "id": "cloud/account-management/enterprise-sso", "title": "Single sign-on (SSO) in Cypress Cloud", "description": "Configure SSO with an enterprise identity provider such as Okta, SAML, Azure AD, or OneLogin for your Cypress Cloud organization.", "section": "cloud", "source_path": "/llm/markdown/cloud/account-management/enterprise-sso.md", "version": "f60251bf707b0077a9535579c9f90d615440cc35", "updated_at": "2026-10-16T10:56:58.670Z", "headings": [ { "id": "cloud/account-management/enterprise-sso#single-sign-on-sso", "text": "Single Sign-On (SSO)", "level": 1 }, { "id": "cloud/account-management/enterprise-sso#getting-started", "text": "Getting Started", "level": 2 }, { "id": "cloud/account-management/enterprise-sso#enable-sso", "text": "Enable SSO", "level": 2 }, { "id": "cloud/account-management/enterprise-sso#sso-provider-configuration", "text": "SSO Provider Configuration", "level": 2 }, { "id": "cloud/account-management/enterprise-sso#okta", "text": "Okta", "level": 3 }, { "id": "cloud/account-management/enterprise-sso#okta-for-government", "text": "Okta for Government", "level": 4 }, { "id": "cloud/account-management/enterprise-sso#saml", "text": "SAML", "level": 3 }, { "id": "cloud/account-management/enterprise-sso#azure-ad", "text": "Azure AD", "level": 3 }, { "id": "cloud/account-management/enterprise-sso#onelogin", "text": "OneLogin", "level": 3 }, { "id": "cloud/account-management/enterprise-sso#save-configuration", "text": "Save Configuration", "level": 2 }, { "id": "cloud/account-management/enterprise-sso#notes", "text": "Notes", "level": 2 } ] }, "chunks": [ { "id": "cloud/account-management/enterprise-sso#getting-started", "doc_id": "cloud/account-management/enterprise-sso", "heading": "Getting Started", "heading_level": 2, "content_markdown": "## Getting Started\n\n**You need two things to get started:**\n\n* A Cypress Cloud account on the **Business** or **Enterprise** plan. See [pricing](https://www.cypress.io/pricing?utm_source=docs.cypress.io&utm_medium=enterprise-sso).\n* You must be an **owner** of your Cypress Cloud organization.\n", "section": "cloud", "anchors": [ "getting-started" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 45 }, { "id": "cloud/account-management/enterprise-sso#enable-sso", "doc_id": "cloud/account-management/enterprise-sso", "heading": "Enable SSO", "heading_level": 2, "content_markdown": "## Enable SSO\n\n1. Log in to [Cypress Cloud](https://cloud.cypress.io) and navigate to the **Integrations** page for your organization.\n2. Scroll down to the **Enterprise SSO** section. Select your SSO provider and take note of the information provided and required. Keep this window open and continue to the [configuration instructions for your specific SSO provider](#SSO-Provider-Configuration) below.\n", "section": "cloud", "anchors": [ "enable-sso" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 73 }, { "id": "cloud/account-management/enterprise-sso#sso-provider-configuration", "doc_id": "cloud/account-management/enterprise-sso", "heading": "SSO Provider Configuration", "heading_level": 2, "content_markdown": "## SSO Provider Configuration\n\nFollow the instructions below for your specific SSO provider.\n\n**Smart Card Authentication**\n\nFor Smart Card implementation, reach out to support at [support@cypress.io](mailto:support@cypress.io) for assistance.\n\n* [Okta](#Okta)\n* [SAML](#SAML)\n* [Azure AD](#Azure-AD)\n* [OneLogin](#OneLogin)\n\n### **Okta**\n\nCypress Cloud can integrate with Okta via SAML. In addition to the documentation below, refer to [Okta's official documentation for setting up a new SAML application.](https://developer.okta.com/docs/guides/saml-application-setup/overview/)\n\n1. Log into your Okta dashboard and head to the **Admin** section.\n \n2. Create a new SAML-based Web application.\n \n3. Supply the following information requested in the Okta setup wizard:\n * **App name:** `Cypress Cloud`\n * **App logo:** [Cypress logo download](https://on.cypress.io/logo)\n * **Single sign on URL:** The URL provided in Cypress Cloud\n * **Audience URI:** The URI provided in Cypress Cloud\n * **Attribute statements:** Add the attribute statements described in Cypress Cloud\n4. Click **Next** then select **I'm an Okta customer** and click **Finish**.\n5. Click the **View Setup Instructions** button in the middle of the page. Cypress Cloud needs the information provided here:\n * Copy the Identity Provider Single sign-on URL to Cypress Cloud.\n * Download the certificate and upload that to Cypress Cloud.\n6. Navigate to the **Assignments** tab and grant your users access to Cypress Cloud.\n7. [Save Configuration](#Save-Configuration).\n\n#### Okta for Government\n\nWe support Okta for Government. Our Okta integration is a standard SAML 2.0 integration rather than an Okta API integration, so the setup steps above apply without change.\n\nTwo values differ from a commercial Okta setup:\n\n* **Identity Provider Single sign-on URL:** copy the URL from your Okta for Government app, not from a commercial Okta app.\n* **X.509 certificate:** download the signing certificate from your Okta for Government app and upload it to Cypress Cloud. Certificates do not transfer between tenants, so an existing commercial Okta certificate will not work.\n\nEverything else stays the same, including the Single sign on URL and Audience URI you copy from Cypress Cloud and the `User.Email`, `User.FirstName`, and `User.LastName` attribute statements.\n\n**Migrating from commercial Okta**\n\nWe store one SSO configuration per organization, so saving your Okta for Government details replaces your existing Okta configuration. Create and test the Okta for Government app before you save, and make the switch outside of peak hours to limit the window in which your team could be locked out.\n\nFor advanced SAML requirements, contact support at [support@cypress.io](mailto:support@cypress.io).\n\n### **SAML**\n\nCypress Cloud can integrate with your identity provider via SAML. In addition to the documentation below, refer to your provider's official documentation for configuring a SAML integration.\n\n1. Log into the admin interface for your identity provider.\n2. Work through the setup wizard supplying the information requested:\n * **App name:** `Cypress Cloud`\n * **App logo:** [Cypress logo download](https://on.cypress.io/logo)\n * **Single sign on URL:** Collect the URL provided by Cypress Cloud\n * **Audience URI:** Collect the URI provided by Cypress Cloud\n * Add a custom mapping of **AttributeStatements** with the following:\n * `User.Email`: User's email\n * `User.FirstName`: User's first name\n * `User.LastName`: User's last name\n3. Collect the sign-on URL and certificate from your identity provider. Supply that to Cypress Cloud.\n4. [Save Configuration](#Save-Configuration).\n\n### **Azure AD**\n\nCypress Cloud can integrate with your identity provider via Azure AD. In addition to the documentation below, refer to the Microsoft Guides for [configuring an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).\n\n1. Log into the Azure portal and create a new Application.\n2. Work through the application setup, supplying the following information when requested:\n * **App name:** `Cypress Cloud`\n * **App logo:** [Cypress logo download](https://on.cypress.io/logo)\n * **Login URL:** Collect the URL provided by Cypress Cloud\n3. Collect the `Client ID` for your application provided in the Application overview page.\n4. Go to **Certificates and Secrets** in your Azure Application and create a new secret that does not expire. Copy this newly-created secret and paste it in the `Azure Client Secret` field in Cypress Cloud.\n5. Under **API Permissions** in Azure AD, ensure the application has access to **User.Read** permissions\n6. Enter the domain used for your Active Directory, as well as the list of SSO domains you wish to allow user to authenticate with, in Cypress Cloud. This is used for SSO discovery from the login screen.\n7. [Save Configuration](#Save-Configuration).\n\n### **OneLogin**\n\nCypress Cloud can integrate with OneLogin via SAML. In addition to the documentation below, refer to [OneLogin's official documentation for configuring a SAML custom connector.](https://onelogin.service-now.com/support?id=kb_article&sys_id=912bb23edbde7810fe39dde7489619de)\n\n1. Log into your OneLogin portal as an administrator and navigate to **Applications > Applications**, then click **Add App**.\n2. Search for **SAML Custom Connector (Advanced)** and select it.\n3. Set the **Display Name** to `Cypress Cloud` and click **Save**.\n4. Open the **Configuration** tab and supply the following:\n * **Audience (EntityID):** The Audience URI provided in Cypress Cloud\n * **ACS (Consumer) URL:** The Single sign-on URL provided in Cypress Cloud\n * **ACS (Consumer) URL Validator:** A regex that matches the ACS URL, for example `^https://cloud\\.cypress\\.io.*`\n5. Open the **Parameters** tab and add the following attribute mappings. Each mapping must be marked **Include in SAML assertion**:\n * `User.Email` → **Email**\n * `User.FirstName` → **First Name**\n * `User.LastName` → **Last Name**\n6. Open the **SSO** tab and collect the following:\n * Copy the **SAML 2.0 Endpoint (HTTP)** and paste it as the Identity Provider Single sign-on URL in Cypress Cloud.\n * Click **View Details** under the X.509 certificate, download the certificate, and upload it to Cypress Cloud.\n7. [Save Configuration](#Save-Configuration).\n", "section": "cloud", "anchors": [ "sso-provider-configuration" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 1187 }, { "id": "cloud/account-management/enterprise-sso#okta", "doc_id": "cloud/account-management/enterprise-sso", "heading": "Okta", "heading_level": 3, "content_markdown": "### **Okta**\n\nCypress Cloud can integrate with Okta via SAML. In addition to the documentation below, refer to [Okta's official documentation for setting up a new SAML application.](https://developer.okta.com/docs/guides/saml-application-setup/overview/)\n\n1. Log into your Okta dashboard and head to the **Admin** section.\n \n2. Create a new SAML-based Web application.\n \n3. Supply the following information requested in the Okta setup wizard:\n * **App name:** `Cypress Cloud`\n * **App logo:** [Cypress logo download](https://on.cypress.io/logo)\n * **Single sign on URL:** The URL provided in Cypress Cloud\n * **Audience URI:** The URI provided in Cypress Cloud\n * **Attribute statements:** Add the attribute statements described in Cypress Cloud\n4. Click **Next** then select **I'm an Okta customer** and click **Finish**.\n5. Click the **View Setup Instructions** button in the middle of the page. Cypress Cloud needs the information provided here:\n * Copy the Identity Provider Single sign-on URL to Cypress Cloud.\n * Download the certificate and upload that to Cypress Cloud.\n6. Navigate to the **Assignments** tab and grant your users access to Cypress Cloud.\n7. [Save Configuration](#Save-Configuration).\n\n#### Okta for Government\n\nWe support Okta for Government. Our Okta integration is a standard SAML 2.0 integration rather than an Okta API integration, so the setup steps above apply without change.\n\nTwo values differ from a commercial Okta setup:\n\n* **Identity Provider Single sign-on URL:** copy the URL from your Okta for Government app, not from a commercial Okta app.\n* **X.509 certificate:** download the signing certificate from your Okta for Government app and upload it to Cypress Cloud. Certificates do not transfer between tenants, so an existing commercial Okta certificate will not work.\n\nEverything else stays the same, including the Single sign on URL and Audience URI you copy from Cypress Cloud and the `User.Email`, `User.FirstName`, and `User.LastName` attribute statements.\n\n**Migrating from commercial Okta**\n\nWe store one SSO configuration per organization, so saving your Okta for Government details replaces your existing Okta configuration. Create and test the Okta for Government app before you save, and make the switch outside of peak hours to limit the window in which your team could be locked out.\n\nFor advanced SAML requirements, contact support at [support@cypress.io](mailto:support@cypress.io).\n", "section": "cloud", "anchors": [ "okta" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 472 }, { "id": "cloud/account-management/enterprise-sso#okta-for-government", "doc_id": "cloud/account-management/enterprise-sso", "heading": "Okta for Government", "heading_level": 4, "content_markdown": "#### Okta for Government\n\nWe support Okta for Government. Our Okta integration is a standard SAML 2.0 integration rather than an Okta API integration, so the setup steps above apply without change.\n\nTwo values differ from a commercial Okta setup:\n\n* **Identity Provider Single sign-on URL:** copy the URL from your Okta for Government app, not from a commercial Okta app.\n* **X.509 certificate:** download the signing certificate from your Okta for Government app and upload it to Cypress Cloud. Certificates do not transfer between tenants, so an existing commercial Okta certificate will not work.\n\nEverything else stays the same, including the Single sign on URL and Audience URI you copy from Cypress Cloud and the `User.Email`, `User.FirstName`, and `User.LastName` attribute statements.\n\n**Migrating from commercial Okta**\n\nWe store one SSO configuration per organization, so saving your Okta for Government details replaces your existing Okta configuration. Create and test the Okta for Government app before you save, and make the switch outside of peak hours to limit the window in which your team could be locked out.\n\nFor advanced SAML requirements, contact support at [support@cypress.io](mailto:support@cypress.io).\n", "section": "cloud", "anchors": [ "okta-for-government" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 245 }, { "id": "cloud/account-management/enterprise-sso#saml", "doc_id": "cloud/account-management/enterprise-sso", "heading": "SAML", "heading_level": 3, "content_markdown": "### **SAML**\n\nCypress Cloud can integrate with your identity provider via SAML. In addition to the documentation below, refer to your provider's official documentation for configuring a SAML integration.\n\n1. Log into the admin interface for your identity provider.\n2. Work through the setup wizard supplying the information requested:\n * **App name:** `Cypress Cloud`\n * **App logo:** [Cypress logo download](https://on.cypress.io/logo)\n * **Single sign on URL:** Collect the URL provided by Cypress Cloud\n * **Audience URI:** Collect the URI provided by Cypress Cloud\n * Add a custom mapping of **AttributeStatements** with the following:\n * `User.Email`: User's email\n * `User.FirstName`: User's first name\n * `User.LastName`: User's last name\n3. Collect the sign-on URL and certificate from your identity provider. Supply that to Cypress Cloud.\n4. [Save Configuration](#Save-Configuration).\n", "section": "cloud", "anchors": [ "saml" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 167 }, { "id": "cloud/account-management/enterprise-sso#azure-ad", "doc_id": "cloud/account-management/enterprise-sso", "heading": "Azure AD", "heading_level": 3, "content_markdown": "### **Azure AD**\n\nCypress Cloud can integrate with your identity provider via Azure AD. In addition to the documentation below, refer to the Microsoft Guides for [configuring an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).\n\n1. Log into the Azure portal and create a new Application.\n2. Work through the application setup, supplying the following information when requested:\n * **App name:** `Cypress Cloud`\n * **App logo:** [Cypress logo download](https://on.cypress.io/logo)\n * **Login URL:** Collect the URL provided by Cypress Cloud\n3. Collect the `Client ID` for your application provided in the Application overview page.\n4. Go to **Certificates and Secrets** in your Azure Application and create a new secret that does not expire. Copy this newly-created secret and paste it in the `Azure Client Secret` field in Cypress Cloud.\n5. Under **API Permissions** in Azure AD, ensure the application has access to **User.Read** permissions\n6. Enter the domain used for your Active Directory, as well as the list of SSO domains you wish to allow user to authenticate with, in Cypress Cloud. This is used for SSO discovery from the login screen.\n7. [Save Configuration](#Save-Configuration).\n", "section": "cloud", "anchors": [ "azure-ad" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 237 }, { "id": "cloud/account-management/enterprise-sso#onelogin", "doc_id": "cloud/account-management/enterprise-sso", "heading": "OneLogin", "heading_level": 3, "content_markdown": "### **OneLogin**\n\nCypress Cloud can integrate with OneLogin via SAML. In addition to the documentation below, refer to [OneLogin's official documentation for configuring a SAML custom connector.](https://onelogin.service-now.com/support?id=kb_article&sys_id=912bb23edbde7810fe39dde7489619de)\n\n1. Log into your OneLogin portal as an administrator and navigate to **Applications > Applications**, then click **Add App**.\n2. Search for **SAML Custom Connector (Advanced)** and select it.\n3. Set the **Display Name** to `Cypress Cloud` and click **Save**.\n4. Open the **Configuration** tab and supply the following:\n * **Audience (EntityID):** The Audience URI provided in Cypress Cloud\n * **ACS (Consumer) URL:** The Single sign-on URL provided in Cypress Cloud\n * **ACS (Consumer) URL Validator:** A regex that matches the ACS URL, for example `^https://cloud\\.cypress\\.io.*`\n5. Open the **Parameters** tab and add the following attribute mappings. Each mapping must be marked **Include in SAML assertion**:\n * `User.Email` → **Email**\n * `User.FirstName` → **First Name**\n * `User.LastName` → **Last Name**\n6. Open the **SSO** tab and collect the following:\n * Copy the **SAML 2.0 Endpoint (HTTP)** and paste it as the Identity Provider Single sign-on URL in Cypress Cloud.\n * Click **View Details** under the X.509 certificate, download the certificate, and upload it to Cypress Cloud.\n7. [Save Configuration](#Save-Configuration).\n", "section": "cloud", "anchors": [ "onelogin" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 261 }, { "id": "cloud/account-management/enterprise-sso#save-configuration", "doc_id": "cloud/account-management/enterprise-sso", "heading": "Save Configuration", "heading_level": 2, "content_markdown": "## Save Configuration\n\nReturn to Cypress Cloud and click **Save Configuration**. Cypress Cloud will attempt to authenticate.\n\n🎉 Your integration is now complete! You can invite all of the users in your organization to sign in through your SSO provider.\n", "section": "cloud", "anchors": [ "save-configuration" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 53 }, { "id": "cloud/account-management/enterprise-sso#notes", "doc_id": "cloud/account-management/enterprise-sso", "heading": "Notes", "heading_level": 2, "content_markdown": "## Notes\n\n* Once SSO is successfully set up, users will need to be invited via your SSO provider, as the Cypress Cloud invitation option will be disabled.\n* All SSO Users are initially added with the [User Role](/llm/markdown/cloud/account-management/users.md#User-roles) of Member. If a User needs different User Role permissions, this can be changed via Cypress Cloud by a current member with the role of Owner or Admin.\n* SSO users are separate accounts from Google/GitHub or email/password users. If there are duplicate users, duplicates can be removed by any [Owner or Admin](/llm/markdown/cloud/account-management/users.md#User-roles).\n", "section": "cloud", "anchors": [ "notes" ], "path": "/llm/json/chunked/cloud/account-management/enterprise-sso.json", "token_estimate": 123 } ] }