Single Sign On

Single Sign-On (SSO) enables customers to allow their users to login to Twilio Console using their corporate Identity Provider (such as Azure Active DIrectory, Okta, Onelogin etc) credentials.

What are the benefits of SSO?

SSO provides security and compliance benefits such as -

1. Using SSO, Twilio Customers can have a single source for authenticating their users (through the IdP). They can also manage security and compliance policies such as password policies and mandating two-factor authentication at a single place.
2. Similarly when users leave their organization, they just have to disable/remove the user from one place.

How does Twilio Console SSO work?

SSO for Twilio Console supports SAML (Security Assertion Markup Language) 2.0 standard. Once SSO is configured, Twilio acts as a Service Provider (SP) and allows users to login either via IdP-initiated flows or SP-initiated flows.

• In order to allow a user to login by SSO, Twilio needs that user to be created first. Twilio doesn’t support Just In-Time (JIT) provisioning.
• Once the user is created, Twilio requires the user’s email address to be the unique identifier (NameID as per SAML terminology) i.e. Twilio will expect the NameID value in SAML assertion to be the user’s email address.
• When SSO is enforced, a user will only be able to login by SSO. They can’t login using their password.
• Twilio SSO only handles the authentication - what accounts a user has access to and what roles the user has aren’t managed by SSO. For managing these, you will need to use the Twilio Console or Admin Center UI.

Features Supported by Twilio Console SSO

1. SP-Initiated and IdP-Initiated Login: Twilio SSO supports both SP-initiated login (when user starts their login process by visiting Twilio Console and entering their email address) and IdP-initiated login (when user clicks on the Twilio app/link/tile from your IdP).
2. SSO Enforcement for users based on Domains: Twilio SSO provides the ability to enforce SSO for users based on their email domains. Once you select the domains and enforce SSO on them -
   1. All existing Managed Users belonging to those domains will get SSO enforced
   2. And any new managed users created for these domains will also get SSO enforced. The users will be required to setup their password during the initial login but from subsequent login sessions they will be required to login via SSO.
   3. Once SSO is enforced for a user, they can’t login using their password. They can login only using SSO.
3. Enable/Disable SSO for specific Managed Users: If you have any specific user(s) who should be allowed to login without SSO then you can disable SSO for them using the Admin Center and enable it again as per needed.
4. Multiple SSO Profiles: Twilio Console now supports multiple SSO profiles. So if you have more than one IdPs which you want to configure with Twilio, you can do so.

Features Not Supported by Twilio Console SSO

1. Just In-Time or Automated User Provisioning
2. Configuring Roles or other attributes via SSO
3. SCIM Provisioning and De-provisioning

Configuring SSO for Twilio Console

Prerequisites

Before starting the configuration for Twilio Console SSO, please check and make sure that you have

• An Identity Provider which supports SAML 2.0
• Created a Twilio Organization and have access to the Admin Center as an Organization Administrator
• Purchased a Twilio Edition that includes Single Sign-On and have got Single Sign-On feature enabled for your Twilio Organization
• Added and Verified the domains to which the users email addresses belong to
• Added or Imported your existing users (for whom SSO needs to be enabled) as managed users in your Organization
  • You can use the Bulk User Import feature to find and import all existing users from your domain

For configuring the SSO you have to follow these steps -

1. You will need to add Twilio (as SP) metadata into your IdP and then configure your IdP metadata into Twilio.
2. Once both sides have the metadata configured, you can test the SSO connection to make sure that everything is in order.
3. Once you have tested a SSO connection, then you can select any of your verified domains to enforce SSO for users belonging to those domains.

Configuration Guides

Please follow the configuration guides specific to your Identity Provider system from the links below. If your Identity Provider system is not listed below, please use the ‘Other SAML 2.0’ guide.

• Azure ActiveDirectory
• Okta
• Other SAML 2.0 Identity Providers

Enabling and Disabling SSO for Specific Managed Users

Note: You will need to first set up an SSO profile before you can enable/disable SSO on specific managed users. See Configuring SSO for Twilio Console if you have not already configured an SSO profile.

1. Go to the Admin Center
2. Click on "Users"
   

   

3. Click on the name of the user for which you wish to enable or disable SSO
4. Select "Enabled" or "Disabled" for the user
5. Acknowledge the pop-up prompt and confirm you wish to enable/disable SSO
   

   

6. Click "Save"