How do I configure SSO?

Single sign-on (SSO) lets your team log in to Fullstory with their identity provider (IdP) credentials. Your teammates don't need a separate Fullstory password, and you apply the same authentication policies to Fullstory as to your other enterprise apps.

Fullstory supports SSO with any IdP that uses the SAML 2.0 protocol, including Okta and Microsoft Entra ID. Users can log in from a Fullstory login page (service provider-initiated) or from your IdP dashboard (IdP-initiated).

This article covers:

• Set up your identity provider
• Set up SSO in Fullstory
• Manage your SSO connection
• Google Authentication
• Frequently Asked Questions

Set up your identity provider

Create an app for Fullstory in your IdP. You have two options:

• Published app (recommended): Okta and Microsoft Entra ID each have a published Fullstory app. It takes fewer steps and less effort.
  • Note: To use SCIM provisioning, create a custom SAML app in Okta or Microsoft Entra ID. The published apps don't currently support SCIM.
• Custom SAML app: Create your own SAML 2.0 app. Use this option if your IdP has no published Fullstory app.

Set up SSO in Fullstory

The SSO setup in Fullstory has three steps: General Settings, Sign On Settings, and Provisioning. Click Next to move forward and Back to return.

You'll need an app for Fullstory in your IdP to finish the Sign On Settings step. See Set up your identity provider.

General Settings

1. In Fullstory, go to Settings > Account Management > SSO. Under Single sign-on (SSO) connection, click Configure next to Generic SSO (SAML 2.0).
2. Enter an SSO connection name. Fullstory may show this name to unauthenticated users during login, so choose a name they'll recognize, like "[Your Company] SSO."
   • Note: The Require SSO for all teammates toggle stays off until you save the SSO connection. This prevents lockouts. See Require SSO for all teammates.
3. Click Next.

Sign On Settings

1. Under Configure the Fullstory App with the Identity Provider (IdP), copy the Assertion Consumer Service (ACS) URL and Entity ID (Audience URL) into your IdP. If your IdP needs it, click Download next to Request Signing Certificate.
2. In your IdP, generate the metadata.xml file. In Fullstory under Connect to the IdP, paste the contents of the metadata.xml file into the Metadata field.
3. Click Next.

Provisioning

Under Account provisioning, choose how Fullstory creates and manages users:

• None: Fullstory doesn't create user accounts automatically. Add users in Fullstory yourself, send an invite, and they log in with SSO.
• Just-in-time (JIT) provisioning: Fullstory creates an account the first time someone logs in from your SAML SSO sign-in page. You spend less time provisioning accounts, and only people your IdP authenticates get access.
  • Note: New users get a Standard seat unless you map users to roles. JIT isn't supported for Google Authentication.
• SCIM provisioning: SCIM (System for Cross-domain Identity Management) lets your IdP create, update, and deactivate users and groups in Fullstory automatically. For setup steps, group management, and role mapping with SCIM, see SCIM Automated Provisioning & De-provisioning.
  • Note: SCIM requires an SSO connection set up in the org itself. It isn't available with Umbrella SSO.

Map users to roles via SAML attribute

Role mapping assigns Fullstory roles from information in your IdP, so you don't update permissions by hand in Settings. It's optional, and it's available with None and JIT provisioning. When you use role mapping, we recommend that you turn on Require SSO for all teammates. If users log in another way, Fullstory doesn't update their roles.

If your IdP sends more than one role for a user, the assignment fails silently and the user's role defaults to Standard. Fullstory doesn't resolve multiple roles automatically.

To map roles:

1. On the Provisioning step, turn on Map users to roles via SAML attribute.
2. In your IdP, add a SAML attribute named fullstoryRole to the SAML response.
3. Set the attribute value for each user to one of these roles: guest, standard, explorer, architect, or admin.
   • Note: Role mapping doesn't support the Umbrella Manager role. Assign it from the Umbrella Users page in Settings. See Choose your umbrella managers.

Here's an example of the SAML attribute:

<saml2:Attribute Name="fullstoryRole"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">
admin
</saml2:AttributeValue>
</saml2:Attribute>

Complete setup

Click Complete setup to save the connection.

Manage your SSO connection

After you save, the three steps become tabs: General Settings, Sign On Settings, and Provisioning. To edit your connection, make your changes, then click Save Changes.

Sign-in URL

The General Settings tab shows your Sign-in URL. Copy it into your IdP as the app's sign-in link, so users can start login from your IdP or a bookmark.

Require SSO for all teammates

New connections start in optional mode. Users can log in with a Fullstory username and password or with SSO.

To require SSO, save the connection, then turn on Require SSO for all teammates on the General Settings tab. After you turn it on, all users with an Explorer, Standard, Admin, Architect, or Umbrella Manager seat type must log in with SSO and can no longer use a username and password.

Domains for SSO login

Under Domains for SSO Login, a Fullstory admin can list their email domain. To add another email domain, invite a teammate who has an email address on that domain and grant them admin access so they can add it. To delete a domain, click Remove.

When SSO is required and someone enters an email address on a listed domain, the Fullstory login page redirects them to your SSO login page.

Free email providers, like Gmail and Outlook, are not supported.

Certificate expiration

The Sign On Settings tab shows when your certificate expires. Update it before the expiration date:

1. On Sign On Settings, click Update metadata.
2. Paste your IdP's new metadata.xml contents.
3. Click Save Changes.

SCIM authorization token

If you use SCIM and lose your token, go to the Provisioning tab and click Generate a new token, then click Generate new token to confirm. Update the token in your IdP afterward.

Google Authentication

Google Authentication is available on all plans. Admins can require all teammates to log in with Google. To learn more, see Using Google Authentication with Fullstory.

Frequently Asked Questions

Does Fullstory support multi-factor authentication (MFA)?

Yes. Fullstory supports MFA configured through your SSO provider or Google Authentication.

What happens when I remove a user from my identity provider?

It depends on your provisioning option:

• None or JIT: Removing a user in your IdP doesn't remove them from Fullstory. Delete them in Fullstory under Settings > Account Management > Users.
• SCIM: Your IdP deprovisions the user in Fullstory automatically. To learn how Okta and Microsoft Entra ID handle deprovisioning, see SCIM Automated Provisioning & De-provisioning.

How do I set up SSO while onboarding with a Fullstory partner?

If you are working with a Fullstory partner or other third party that needs access to your Fullstory account, set the Require SSO for all teammates toggle to off. This allows your internal team to continue using SSO while external users log in with a username and password. If you need Require SSO for all teammates to remain on, add the third-party email addresses in your identity provider so they can authenticate through your SSO flow.