Set up single sign-on

• Simplify the login process. To access Unity products and services, users sign in with their company's credentials instead of a Unity ID and password.
• Reduce the risk of lost or stolen passwords through a single authentication point.
• Improve the administration workflow through user provisioning on the first user sign-in.

• Unity Enterprise
• Unity Industry plan

Prerequisites

• You must have the Owner or Manager user type within your organization. Read more about user types, roles, and permissions.
• You must have created a SAML 2.0 application in your Identity Provider (IdP) service. Unity SSO uses the Security Assertion Markup Language (SAML) 2.0 protocol. This protocol enables secure communication between the IdP and Unity. Unity SSO supports the following IdPs:
  • Okta
  • Microsoft Entra ID
  • Google Cloud Identity
  • JumpCloud

Create a SAML 2.0 application in your IdP service

1. Go to your organization's IdP portal and create a SAML 2.0 application.
2. On a new tab, go to the Unity Dashboard, open the Account menu and select Manage organization.
3. In the Administration menu, select SSO.
4. Copy the values of the following metadata parameters from the Unity section:

   • Entity ID

   • Login (Assertion Consumer Service) URL

   • Certificate

5. Go back to your IdP portal and paste the values in the corresponding fields of the SAML settings.
6. Add custom user attribute mapping to your SAML 2.0 connector in your IdP:
   1. For the custom attribute name, enter

      Email

      .
   2. Select the user's email address in the IdP as the field. To authenticate the user, Unity SAML SSO needs the

      Email

      attribute.

Configure SSO for your organization

1. In the Unity Dashboard, open the Account menu and select Manage organization.
2. In the Administration menu, select SSO.
3. Select Edit information next to the Identity Provider section.
4. On a new tab, go to your organization's IdP portal.
5. From the settings page of your SAML application, generate the following metadata parameters of the application:

   • Entity ID

     : the IdP that you're using. This parameter may be named identity provider issuer or issuer URL.

   • SSO Login URL

     : the IdP login URL.

   • X.509

     : the IdP certificate.
6. Go back to the Single sign on page of Unity Cloud and paste the values in the corresponding fields.
7. Save your changes.

Validate domains for SSO

• Domain ownership: domain validation ensures legitimate ownership and control of the domain.
• Fraudulent activity: domain validation helps prevent domain impersonation and the fraudulent configuration of applications.
• Trust anchor: domain validation acts as a form of trust anchor. Other parties can't easily perform these actions:
  • Claim to represent the organization, for example, your domain.
  • Configure applications or services for unauthorized access or misuse of the organization's identity.

1. Sign in to the Unity Dashboard as the SSO configuration IT administrator.
2. Open the Account menu and select Manage organization.
3. In the Administration menu, select SSO, and then select Add domain.
4. Enter the domain for which you want to turn on SSO, and then select Add and validate.
5. Copy the entire DNS TXT record from the domain information window.
6. Go to the DNS management panel of your domain registrar.
7. Create a DNS record of TXT type and paste the copied content into it.
8. In the Unity Dashboard, select Validate.
9. To turn on SSO for other domains, repeat this procedure.

Turn off SSO for specific domains

1. In the Unity Dashboard, open the Account menu and select Manage organization.
2. In the Administration menu, select SSO.
3. On the Domains tab, select Delete next to the domain for which you want to turn off SSO.

Enforce SSO authentication

1. In the Unity Dashboard, open the Account menu and select Manage organization.
2. In the Administration menu, select SSO.
3. On the Single Sign-On tab, turn on Enforce SSO authentication. All users from domains for which SSO is enforced lose access to other sign-in methods, unless they are in the allowlist.
   注

   Users whose enterprise domain is from Google Workspace must use SSO when signing in to their Google workspace. We recommend that these users avoid choosing Google when signing in to Unity. Otherwise, Unity SSO enforcement redirects these users to their IdP a second time.

Manage exceptions

1. In the Unity Dashboard, open the Account menu and select Manage organization.
2. In the Administration menu, select SSO.
3. On the Allowlist tab, select Add email.
4. Enter an email from a verified domain and a reason.
5. Select Add.

Test the SAML SSO integration

Sign in to your IdP application directory

1. Go to your IdP application directory.
2. Use the IdP flow. This flow redirects you to the Unity SSO sign-in page.
3. Enter the email for a test user, and then select Sign in.

Sign in to Unity Cloud

1. Sign out of Unity Cloud.
2. Go to the Unity Dashboard.
3. Select Sign in, and then select Sign in with SSO.
4. Enter the email for a test user, and then select Sign in.

Considerations

• When users create a Unity ID account through SSO, Unity doesn't create the following information:
  • A password The next time they sign in, users must select Forgot your password? and set up their password.
  • A personal organization for the new account To create projects, users must manually create their own personal organization.
• When signing in through SSO, users are automatically assigned to the organization for which SSO is set up. After sign-in, users can switch organizations and access the other organizations which they're a member of.

Next steps

• Automate the provisioning of users with Okta
• Automate the provisioning of users with JumpCloud