There are two options for configuring single sign-on (SSO) in your FullStory account: SAML SSO and Google Authentication. Read on to learn more.
FullStory can integrate with your company's Single Sign-On solution so that team members can log in to FullStory using their SSO credentials. This eliminates the need for your users to have separate FullStory credentials, and enables you to apply the same authentication policies to FullStory as you do with your other enterprise apps.
Just-in-Time (JIT) Provisioning
Spend less time provisioning accounts and ensure only the right employees have access with Just-in-Time (JIT) provisioning for SAML. New users can be automatically provisioned when they first log in from your enterprise SAML SSO sign-in page.
Which Identity Providers are supported?
Our SSO offering supports all major Identity Providers who use the SAML 2.0 protocol. This includes Okta, Azure AD, and many others.
Which SSO flows are supported?
We support both Service Provider-initiated SSO (in which users log in via a FullStory login page) as well as Identity Provider-Initiated SSO (in which users log in from your IdP dashboard).
How do I configure SSO?
Note: If you're setting up SSO for the first time in an Umbrella account, repeat these steps for each account in your Umbrella. If you enabled SSO in an Umbrella account prior to May 2020, please contact support for help managing your configuration.
Admin users can configure SSO in FullStory under Settings > SSO. Click Configure SSO to get started.
Enter your Connection Name. The Connection Name may be shown to unauthenticated users during the log-in process, so choose something intuitive like “Your Company Name SSO.”
Next, copy and paste the information provided–including the SSO URL, Audience URL/Entity ID, and Request Signing Certificate–into your IdP to generate a metadata.xml file. Then, copy and paste the contents of your IdP-generated metadata.xml file into FullStory to complete the configuration.
How do I customize my SSO settings?
After you configure SSO, customize your settings under Settings > SSO.
Requiring SSO for all teammates
When SSO is initially configured, it defaults to “optional” mode. In optional mode, users can log in with a FullStory username and password or with SSO. At any time, your FullStory admin can toggle on “Require SSO for all teammates.” Once enabled, all users will be required to log in with SSO and users will no longer be able to log in with their usernames and passwords.
Enabling just-in-time seat provisioning
Toggle on “Automatically create new user accounts (just-in-time seat provisioning) to enable JIT. When enabled, new users can be automatically provisioned when they first log in from your enterprise SAML SSO sign-in page.
Anything else I should know?
Two quick things! First, be sure to note your certificate expiration date. You’ll need to update your certificate manually before it expires under Settings > SSO.
Second, deleting a user from your Identity Provider does not automatically delete them from your FullStory team. To free up their seat, you’ll also need to manually delete them from FullStory.
The ability to authenticate with Google is available to all customers. Team administrators can choose to require all team members to log in via Google. You can learn more about Google Authentication in this article. Note that Just-in-Time provisioning is not supported for Google Authentication at this time.