Umbrella SSO

Umbrella SSO lets you set up single sign-on (SSO) once for your Umbrella, then assign that connection to the sub-accounts you choose. You skip repeating setup in each sub-account, and your teammates log in the same way they do with SSO configured on one sub-account.

Fullstory supports Umbrella SSO with any identity provider (IdP) that uses the SAML 2.0 protocol, including Okta and Microsoft Entra ID. To set up SSO for a single sub-account, see How do I configure SSO?

How Umbrella SSO differs from SSO

• One connection, many sub-accounts: You configure the connection at the Umbrella level and choose which sub-accounts use it. Fullstory selects none by default.
• None or JIT provisioning only: SCIM provisioning isn't supported with Umbrella SSO. A sub-account that needs SCIM stays on its own SSO connection.
• No role mapping: Mapping roles via SAML attribute isn't supported with Umbrella SSO. With JIT, new users get a Standard seat, and an admin can change the role afterward.
• One connection per Umbrella: Each Umbrella and each sub-account supports one live SSO connection.
• Umbrella Managers own the connection: Admins in assigned sub-accounts see their SSO page as read-only and labeled Umbrella Managed.

This article covers:

• Set up your identity provider
• Set up Umbrella SSO in Fullstory
• Manage your Umbrella SSO connection
• What sub-account admins see
• Frequently Asked Questions

Set up your identity provider

Create one app for Fullstory in your IdP. Every sub-account you assign uses this app and the same connection. You have two options:

• Published app (recommended): Okta and Microsoft Entra ID each have a published Fullstory app. It takes fewer steps and less effort.
• Custom SAML app: Create your own SAML 2.0 app. Use this option if your IdP has no published Fullstory app.

For steps by IdP, see Set up your identity provider in How do I configure SSO?

Set up Umbrella SSO in Fullstory

General Settings

1. In Fullstory, go to Settings > Umbrella > SSO.
2. Under Single sign-on (SSO) connection, click Configure next to Generic SSO (SAML 2.0).
3. Enter an SSO connection name. Fullstory may show this name to unauthenticated users during login, so choose a name they'll recognize, like "[Your Company] SSO."
   • Note: The Require SSO for all teammates toggle stays off until you save the connection. This prevents lockouts. See Require SSO for all teammates.
4. Click Next.

Sign On Settings

1. Under Configure the Fullstory App with the Identity Provider (IdP), copy the Assertion Consumer Service (ACS) URL and Entity ID (Audience URL) into your IdP. If your IdP needs it, click Download next to Request Signing Certificate.
2. In your IdP, generate the metadata.xml file. In Fullstory under Connect to the IdP, paste the contents of the metadata.xml file into the Metadata field.
3. Click Next.

Provisioning

1. Under Account provisioning, choose how Fullstory creates users: None or Just-in-time (JIT) provisioning.
   • None: Fullstory doesn't create user accounts automatically. Add users in Fullstory yourself, send an invite, and they log in with SSO.
   • Just-in-time (JIT) provisioning: Fullstory creates a seat the first time someone logs in from your SAML SSO sign-in page. When the user logs in, they select a sub-account, and Fullstory creates their seat there.
     • Note: New users get a Standard seat. An admin can change the role after Fullstory creates the seat. JIT isn't supported for Google Authentication.
2. Click Next.

Account Assignment

Under Select the accounts that will authenticate via this Umbrella setup, choose the sub-accounts that use this connection.

1. Turn on Umbrella SSO for each sub-account that should log in with this connection. The Current SSO column shows what each sub-account uses today.
2. Check sub-accounts that already have SSO. Assigning Umbrella SSO overrides their existing connection. Fullstory keeps the sub-account's prior configuration and restores it if you later remove the sub-account from Umbrella SSO. Fullstory shows a warning before you confirm.
3. To apply Umbrella SSO to a sub-account with SCIM enabled, first disable SCIM on the sub-account, then return here to assign it. Fullstory can't assign a sub-account while SCIM is on.

Complete setup

Click Complete setup to save the connection.

Manage your Umbrella SSO connection

After you save, the four steps become tabs: General Settings, Sign On Settings, Provisioning, and Account Assignment. For any edits or updates, make your changes, then click Save Changes.

Sign-in URL

The General Settings tab shows your Sign-in URL. Copy it into your IdP as the app's sign-in link, so users can start login from your IdP or a bookmark.

Require SSO for all teammates

New connections start in optional mode. Users can log in with a Fullstory username and password or with SSO.

To require SSO, save the connection, then turn on Require SSO for all teammates on the General Settings tab. After you turn it on, all users with an Explorer, Standard, Admin, Architect, or Umbrella Manager seat type in assigned sub-accounts must log in with SSO and can no longer use a username and password. Sub-accounts you haven't assigned keep their own settings.

Domains for SSO login

Under Domains for SSO Login, list your email domains. When SSO is required and someone enters an email address on a listed domain, the Fullstory login page redirects them to your SSO login page.

To delete a domain, click Remove.

Free email providers, like Gmail and Outlook, aren't supported.

Certificate expiration

The Sign On Settings tab shows when your certificate expires. Update it before the expiration date:

1. On Sign On Settings, click Update metadata.
2. Paste your IdP's new metadata.xml contents.
3. Click Save Changes.

Add or remove sub-accounts

On the Account Assignment tab, turn Umbrella SSO on or off for each sub-account, then click Save Changes. When you turn it off, the sub-account returns to the SSO configuration it had before you assigned it.

What sub-account admins see

After you assign a sub-account, its SSO page under Settings > Account Management > SSO is read-only and labeled Umbrella Managed. Admins can't edit the connection there. Ask an Umbrella Manager to make changes at the Umbrella level.

Frequently Asked Questions

Does Fullstory support multi-factor authentication (MFA)?

Yes. Fullstory supports MFA configured through your SSO provider or Google Authentication.

Does Umbrella SSO work with SCIM or role mapping?

No. For provisioning, Umbrella SSO supports None and Just-in-time (JIT) provisioning. If a sub-account needs SCIM or role mapping, keep it on its own SSO connection. To use Umbrella SSO on a sub-account that has SCIM on, disable SCIM first. See Account Assignment.

Do I have to assign every sub-account?

No. Fullstory selects no sub-accounts by default. Sub-accounts you don't assign keep their own SSO connection, including a different IdP.

What happens to a sub-account's existing SSO when I assign it?

Umbrella SSO overrides it, and Fullstory keeps the prior configuration. If you remove the sub-account from Umbrella SSO, it returns to that configuration.

Can I use more than one SSO connection?

Each Umbrella and each sub-account supports one live SSO connection.

What happens when I remove a user from my identity provider?

For sub-accounts with Umbrella SSO, removing a user in your IdP doesn't remove them from Fullstory, because Umbrella SSO doesn't support SCIM. To remove a user from Fullstory, remove them under Settings > Account Management > Users. For details, see User Management.

What if the Umbrella connection breaks or is misconfigured?

One connection serves every assigned sub-account, so a problem affects all of them at once. To fix it, update the connection once at the Umbrella level.

How do I set up Umbrella SSO while onboarding with a Fullstory partner?

If a Fullstory partner or other third party needs access to your Fullstory account, turn off Require SSO for all teammates. Your internal team keeps using SSO, and external users log in with a username and password.

To keep Require SSO for all teammates on, add the third party's email addresses in your IdP so they can authenticate through your SSO flow.