Single Sign On

SSO provides security and compliance benefits such as -

1. Using SSO, Twilio Customers can have a single source for authenticating their users (through the IdP). They can also manage security and compliance policies such as password policies and mandating two-factor authentication at a single place.
2. Similarly when users leave their organization, they just have to disable/remove the user from one place.

SSO for Twilio Console supports SAML (Security Assertion Markup Language) 2.0 standard. Once SSO is configured, Twilio acts as a Service Provider (SP) and allows users to log in either via IdP-initiated flows or SP-initiated flows.

• To allow a user to log in by SSO, Twilio needs that user to be created first. Twilio doesn't support Just In-Time (JIT) provisioning.

• Once the user is created, Twilio requires the user's email address to be the unique identifier (NameID as per SAML terminology) i.e. Twilio will expect the NameID value in SAML assertion to be the user's email address.

• When SSO is enforced, a user will only be able to log in by SSO. They can't log in using their password.

• Twilio SSO only handles the authentication - what accounts a user has access to and what roles the user has aren't managed by SSO. To manage these, you will need to use the Twilio Console or Admin Center UI.

1. SP-Initiated Login with Proof Key for Code Exchange (PKCE): Twilio SSO supports SP-initiated login (when the user starts their login process by visiting Twilio Console and entering their email address) PKCE to secure user authentication to Twilio. Any IdP-initiated login attempts to the Twilio Console (when a user clicks on the Twilio app, link, or tile from your IdP) are converted to SP-initiated and then proceed to authenticate the user by sending a SAML authentication request to your IDP.

2. SSO Enforcement for Users Based on Domains: Twilio SSO provides the ability to enforce SSO for users based on their email domains. Once you select the domains and enforce SSO on them -

   1. All existing Managed Users belonging to those domains will get SSO-enforced
   2. And any new managed users created for these domains will also get SSO enforced. The users will be required to set up their password during the initial log-in but from subsequent log-in sessions, they will be required to log in via SSO.
   3. Once SSO is enforced for a user, they can't log in using their password. They can log in only using SSO.

3. Enable/Disable SSO for specific Managed Users: If you have any specific user(s) who should be allowed to log in without SSO then you can disable SSO for them using the Admin Center and enable it again as needed.

4. Multiple SSO Profiles: Twilio Console now supports multiple SSO profiles. So if you have more than one IdPs that you want to configure with Twilio, you can do so.

1. Just-In-Time or Automated User Provisioning
2. Configuring Roles or other attributes via SSO

Before starting the configuration for Twilio Console SSO, please check and make sure that you have

• An Identity Provider which supports SAML 2.0

• Created a Twilio Organization and have access to the Admin Center as an Organization Administrator

• Purchased a Twilio Edition that includes Single Sign-On and has got Single Sign-On feature enabled for your Twilio Organization

• Added and Verified the domains to which the users email addresses belong to

• Added or Imported your existing users (for whom SSO needs to be enabled) as managed users in your Organization

  • You can use the Bulk User Import feature to find and import all existing users from your domain

To configure the SSO you have to follow these steps -

1. You will need to add Twilio (as SP) metadata into your IdP and then configure your IdP metadata into Twilio.
2. Once both sides have the metadata configured, you can test the SSO connection to make sure that everything is in order.
3. Once you have tested an SSO connection, then you can select any of your verified domains to enforce SSO for users belonging to those domains.

Please follow the configuration guides specific to your Identity Provider system from the links below. If your Identity Provider system is not listed below, please use the 'Other SAML 2.0' guide.

• Azure ActiveDirectory
• Okta
• Other SAML 2.0 Identity Providers

Note: You will need to first set up an SSO profile before you can enable/disable SSO on specific managed users. See Configuring SSO for Twilio Console if you have not already configured an SSO profile.

1. Go to the Admin Center

2. Click on "Users"

   Expand image

3. Click on the name of the user for which you wish to enable or disable SSO

4. Select "Enabled" or "Disabled" for the user

5. Acknowledge the pop-up prompt and confirm you wish to enable/disable SSO

   Expand image

6. Click "Save"

   Expand image