Objective

This article walks through creating a single sign-on (SSO) profile for your Twilio organization so your users log in to the Twilio Console with their corporate identity provider credentials. Twilio supports all SAML 2.0 based identity providers, including Azure Active Directory, Okta, and OneLogin.

Product

Twilio Organizations

Environment

Twilio Console

User Account Permission/Role(s) Required

SSO profile create permission. Without it, the Create SSO profile / Add SSO profile button is not shown.

Procedure

1. In the Twilio Console, select Settings in the left sidebar.
2. Select Organization settings, then Single sign-on (SSO).
3. Select Create SSO profile (or Add SSO profile if you already have one). The setup wizard opens with four steps.
4. Configure your IDP, take Twilio's metadata into your identity provider:
5. Either select Download XML to download the profile and import it into your identity provider, or copy the values under Metadata links: Audience URL/Entity ID, Assertion consumer service (ACS)/ SSO URL, Recipient URL (Optional), and Destination URL (Optional).
6. Under Acknowledgement, tick both boxes: that you have configured the NameID format as EmailAddress with the user's email address as its value, and that you have configured both the SAML Response and SAML Assertion to be signed.
7. Select Next.
8. Configure Twilio, provide the SAML metadata from your identity provider:
9. Single sign-on method is fixed to SAML 2.0.
10. Friendly name for profile, the name Twilio uses to refer to this configuration.
11. Issuer ID/URL, Single sign-on URL, and X.509 certificate public key, all three can be found in the SAML section of your identity provider console.
12. Select Next.
13. Test, confirm Twilio can reach your identity provider:
14. Select Test SSO connection. A new tab opens and redirects you to your identity provider for authentication; on success you are redirected back to Twilio and see a success message.
15. Select Next.
16. Enforce, decide which domains SSO applies to:
17. In Select a verified domain, choose the verified domains whose users must log in with SSO. You can leave this empty and enforce later.
18. Select Finish. If you selected domains, the Enforce SSO? dialog appears, tick I acknowledge this information. and select Confirm.
19. A success message confirms "SSO profile configured!", either that the profile is active and enforced on the selected domains, or that it is configured and you can enforce it on domains later.

Additional Information

• SSO can only be enforced on users whose email addresses belong to one of your organization's verified domains. If a domain is missing from the list, verify it first.
• Twilio requires the certificate in PEM format. A certificate pasted without the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines is wrapped for you.
• Friendly name for profile must be at most 64 characters and contain at least one letter. Issuer ID/URL must be at most 128 characters. Single sign-on URL must be an http or https address.
• If you select Next on the Test step without having tested, the Skip testing the connection? dialog warns that if the connection is not set up correctly, all users with enforced SSO will not be able to log in. Select I tested the connection to continue anyway.
• Enforcing SSO takes a few minutes to apply to your users, is not applied to the administrator performing the action, and does not close any active sessions.
• The wizard is resumable. If you exit before finishing, the Exit SSO Profile Configuration? dialog appears, choose Exit to keep the partly-configured profile and return to the list, or Continue setup to stay in the wizard. Exiting never deletes the profile; resume it by selecting it from the list page.
• You can create up to 10 SSO profiles. Beyond that, you must delete an existing profile before creating a new one.
• If the setup cannot be loaded, the page shows "Unable to load SSO profile setup" and suggests reloading.

This content was generated by AI and reviewed, edited, and verified by a human.