There are two options for configuring single sign-on (SSO) in your FullStory account: SAML SSO and Google Authentication. Read on to learn more.
FullStory can integrate with your company's Single Sign-On solution so that team members can log in to FullStory using their SSO credentials. This eliminates the need for your users to have separate FullStory credentials, and enables you to apply the same authentication policies to FullStory as you do with your other enterprise apps.
Just-in-Time (JIT) Provisioning
Spend less time provisioning accounts and ensure only the right employees have access with Just-in-Time (JIT) provisioning for SAML. New users can be automatically provisioned when they first log in from your enterprise SAML SSO sign-in page.
Which Identity Providers are supported?
Our SSO offering supports all major Identity Providers who use the SAML 2.0 protocol. This includes Okta, Azure AD, and many others.
Which SSO flows are supported?
We support both Service Provider-initiated SSO (in which users log in via a FullStory login page) as well as Identity Provider-Initiated SSO (in which users log in from your IdP dashboard).
How do I configure SSO?
Note: If you're setting up SSO for the first time in an Umbrella account, repeat these steps for each account in your Umbrella. If you enabled SSO in an Umbrella account prior to May 2020, please contact support for help managing your configuration.
Admin users can configure SSO in FullStory under Settings > Account Management > SSO. Click Configure SSO to get started.
Enter your Connection Name. The Connection Name may be shown to unauthenticated users during the log-in process, so choose something intuitive like “Your Company Name SSO.”
Next, copy and paste the information provided–including the SSO URL, Audience URL/Entity ID, and Request Signing Certificate–into your IdP to generate a metadata.xml file. Then, copy and paste the contents of your IdP-generated metadata.xml file into FullStory to complete the configuration.
How do I customize my SSO settings?
After you configure SSO, customize your settings under Settings > Account Management > SSO.
In the Domains and Certificate section, a FullStory admin can list their email domain. If additional email domains need to be added, a teammate with the additional domain must be invited and granted admin access to add the additional domain.
After adding email domains, if any user enters a known domain that requires SSO, the FullStory standard login page will recognize this and redirect that user to your SSO login page.
Requiring SSO for all teammates
When SSO is initially configured, it defaults to “optional” mode. In optional mode, users can log in with a FullStory username and password or with SSO. At any time, your FullStory admin can toggle on “Require SSO for all teammates.” Once enabled, all users will be required to log in with SSO and users will no longer be able to log in with their usernames and passwords.
Enabling just-in-time seat provisioning
Toggle on “Automatically create new user accounts (just-in-time seat provisioning) to enable JIT. When enabled, new users can be automatically provisioned when they first log in from your enterprise SAML SSO sign-in page.
Anything else I should know?
Two quick things! First, be sure to note your certificate expiration date. You’ll need to update your certificate manually before it expires under Settings > Account Management > SSO.
Second, deleting a user from your Identity Provider does not automatically delete them from your FullStory team. To free up their seat, you’ll also need to manually delete them from FullStory.
The ability to authenticate with Google is available to all customers. Team administrators can choose to require all team members to log in via Google. You can learn more about Google Authentication in this article. Note that Just-in-Time provisioning is not supported for Google Authentication at this time.