Configure OIDC SSO with Entra ID
Opti ID lets you configure OpenID Connect (OIDC) SSO with Entra ID as the IdP. With this setup, Entra ID authenticates and authorizes your users.
You should set up SSO for your organization before inviting new users. After you set up SSO with Opti ID, users must log in to Opti ID using credentials for the SSO provider going forward. This includes the technical contact who originally set up Opti ID for your organization.
Configure the SSO connection
Important
If you configure your SSO app to require Proof Key for Code Exchange (PKCE), you must submit a support ticket after you complete the app configuration so Optimizely can enable it.
- In the Microsoft Entra ID portal, if you have access to multiple tenants, go to Settings and switch to the tenant you want to register as the SSO application for Opti ID.
- Search for and select Microsoft Entra ID.
- Click Enterprise applications.
- Click New application.
- Click Create your own application and complete the following:
- Name – Enter a name for the application (for example, Optimizely SSO).
- What are you looking to do with your application – Select Integrate any other application you don't find in the gallery (Non-gallery).
- Click Create. The app properties display, including the automatically generated Application ID, which uniquely identifies your application within the IdP.
- Copy and save the Application ID. You will need it in the next section.
- Go to Home > App registrations.
- Click on View all applications in the directory.
- Search for and select the app you just created.
- Go to Manage > Authentication (Preview) > Redirect URI configuration > Add redirect URI.
- Select Web as the application type.
- Enter https://login.optimizely.com/oauth2/v1/authorize/callback in the Redirect URIs field and click Configure.
- Go to Certificates & secrets and click Client secrets > New client secret to generate a client secret for your app. Enter the following, then click Add:
- Description – Enter the description (for example, Optimizely SSO).
- Expires – Select 730 days (24 months).
Important
Copy the secret after it is generated.
- Go to Manage > Token configuration > Add optional claim and complete the following:
- Token type – Select ID.
- Claims – Select email, family_name, and given_name.
- Click Add. A verification message with a checkbox displays stating that you must configure OIDC scopes for the selected claims. Select the Turn on the Microsoft Graph email, profile permission (required for claims to appear in token) checkbox, and click Add.
Important
If your claims display a warning icon after you add them, that means you did not select the checkbox in step 15. You must select that checkbox for the claims to work.
- Gather the following information from this new application, which you will use to configure SSO in Opti ID:
- Application ID – From step 7.
- Client secret – From step 13.
- OpenID Connect metadata document URL – On the Overview > Endpoints page of the application registration.
- Log in to Opti ID (https://login.optimizely.com) using your technical contact email and password. For more information about properly activating the technical contact user, see Technical contact login. After you log in, you should be on the home dashboard (home.optimizely.com/dashboard).
- Click Admin Center.
- Go to Settings > SSO > Add SSO Connection, select OIDC as the connection type, and complete the following fields:
- Connection Name – Enter a name for this SSO connection to display when users log in. This helps distinguish between multiple SSO connections.
- Provider – Select EntraID.
- Client ID – Enter the Application (client) ID from step 12.
- Client Secret – Enter the secret from step 9 (also collected in step 12).
- Well Known Metadata URL – Enter the OpenID Connect metadata document URL from step 12.
- Click Save. If the Authorization URL, Issuer URL, JWKS URL, and Token URL fields do not automatically populate based on the metadata URL, you must manually configure them.
- Test your SSO connection by logging out of Opti ID and logging back in. The login flow should now direct you to your Entra ID provider.
Important
In accordance with your company policy, configure your Opti ID SSO application to enforce authentication on each login for added security or maintain user sessions for a specified duration to balance security and user convenience.
Configure IdP-initiated login
After you configure your SSO connection, you can enable IdP-initiated login, which lets users who are already logged in with your organization's SSO provider navigate to Opti ID without the need to log in again.
Test the SSO connection
One of the users you assigned in the OIDC application should test the setup. They need to be a user in the Opti ID Admin Center but logged out.
- Open an incognito window and go to https://login.optimizely.com.
- When you enter your email and click Next, it should redirect you to your organization's IdP.
- Double-check your settings if there are any issues with signing in with your incognito window.
If it does not work correctly, see the Opti ID troubleshooting articlesOpti ID troubleshooting articles. If you cannot resolve the issue, contact Optimizely Support.