Setting up Okta single sign-on for Contact Center

<body>
<div class="article-banners" translate="no">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>
<div class="article-banner" id="addon_contact-center">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Contact Center</td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">
Set up Okta single sign-on for your Contact Center to streamline user authentication. This involves creating a SAML application in Okta, configuring SAML integration, assigning users, and specifying the identity provider for agent authentication. This setup enhances security and simplifies access management across Amazon Connect and your Contact Center.
</p>
</div>
<div class="body">
<p class="p">You can configure Amazon Connect and Contact Center for SSO with Okta as the SAML-based
identity provider. Each requires a SAML application to authenticate. You create the SAML
applications in the Okta portal.</p>
<p class="p">The Okta SAML application, along with an AWS Identity and Access Management (IAM)
provider, enables federation between Okta and your AWS IAM users.</p>
<p class="p">This article contains the following topics:</p>
<ul class="ul" id="LM_contact_center_sso__ul_v4f_tzw_zfc">
<li class="li"><a class="xref" href="#topic_lnb_rzw_zfc">Configuring SSO for Amazon Connect</a></li>
<li class="li"><a class="xref" href="#topic_mtr_s3k_1gc">Configuring SSO for Contact Center</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_lnb_rzw_zfc">
<h2 class="title topictitle2" id="ariaid-title2">Configuring SSO for Amazon Connect</h2>
<div class="body">
<p class="p">Refer to the <a class="xref" href="https://catalog.workshops.aws/amazon-connect-sso/en-US/1-sso-amazonconnect-okta" target="_blank">AWS guide</a> to configure Amazon Connect SSO
with Okta as the identity provider.</p>
<p class="p">Use Service Control Policies (SCPs) to manage user and role permissions in Amazon
Connect, protecting important resources and making your system more secure. Refer to
the <a class="xref" href="https://docs.aws.amazon.com/connect/latest/adminguide/security-best-practices.html" target="_blank">Security best practices for Amazon Connect</a>
for more best practices.</p>
<p class="p">The following is an example SCP that you can use to prevent the deletion of the
Amazon Connect instance and associated role.</p>
<pre class="pre">&lt;pre&gt;&lt;code class="language-json"&gt;
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonConnectRoleDenyDeletion",
"Effect": "Deny",
"Action": [
"iam:DeleteRole"
],
"Resource": [
"arn:aws:iam::*:role/***Amazon Connect user role***"
]
},
{
"Sid": "AmazonConnectInstanceDenyDeletion",
"Effect": "Deny",
"Action": [
"connect:DeleteInstance"
],
"Resource": [
"***Amazon Connect instance ARN***"
]
}
]
}
&lt;/pre&gt;&lt;/code&gt;</pre>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_mtr_s3k_1gc">
<h2 class="title topictitle2" id="ariaid-title3">Configuring SSO for Contact Center</h2>
<div class="body">
<p class="p">Configuring SSO for Contact Center includes the following steps:</p>
<ul class="ul" id="topic_mtr_s3k_1gc__ul_y4f_tzw_zfc">
<li class="li"><a class="xref" href="#topic_arn_h4k_1gc">Step 1: Create a SAML application in Okta</a></li>
<li class="li"><a class="xref" href="#topic_kjj_34k_1gc">Step 2: Configure SAML integration for your Okta application</a></li>
<li class="li"><a class="xref" href="#topic_zwj_34k_1gc">Step 3: Assign users to your application</a></li>
<li class="li"><a class="xref" href="#topic_imk_34k_1gc">Step 4: Specify the identity provider to be used for agent authentication</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested2" id="topic_arn_h4k_1gc">
<h3 class="title topictitle3" id="ariaid-title4">Step 1: Create a SAML application in Okta</h3>
<div class="body">
<p class="p">To enable the federation between Okta and your AWS IAM users, create a SAML
application in Okta.</p>
<p class="p"><strong class="ph b">To create a SAML application</strong></p>
<ol class="ol" id="topic_arn_h4k_1gc__ol_y1r_1zk_1gc">
<li class="li">Open the Okta developer console. </li>
<li class="li">In the navigation menu, expand Applications, then click
<strong class="ph b">Applications</strong>.</li>
<li class="li">Click <strong class="ph b">Create app integration</strong>.</li>
<li class="li">In the Create a new app integration menu, select SAML 2.0 as the sign-in
method.</li>
<li class="li">Click <strong class="ph b">Next</strong>.</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested2" id="topic_kjj_34k_1gc">
<h3 class="title topictitle3" id="ariaid-title5">Step 2: Configure SAML integration for your Okta application</h3>
<div class="body">
<p class="p">In this step, you'll configure the SAML integration for your Okta
application.</p>
<p class="p"><strong class="ph b">To configure SAML integration</strong></p>
<ol class="ol" id="topic_kjj_34k_1gc__ol_akq_fbl_1gc">
<li class="li">On the Create SAML integration page, under General settings, enter a name
for your app, then click <strong class="ph b">Next</strong>.</li>
<li class="li">Complete the following fields:<ul class="ul" id="topic_kjj_34k_1gc__ul_bpf_tzw_zfc">
<li class="li">
<strong class="ph b">Single sign on URL:</strong>
https://<em class="ph i">${yourDomainPrefix}</em>.auth.<em class="ph i"><strong class="ph b">$</strong>{region}</em>.amazoncognito.com/saml2/idpresponse</li>
<li class="li">
<strong class="ph b">Audience URI (SP Entity ID):</strong> urn:amazon:cognito:sp:
<em class="ph i">${yourUserPoolId}</em><p class="p">Replace <em class="ph i">${yourDomainPrefix}</em>,
<em class="ph i">${region}</em>, and <em class="ph i">${yourUserPoolId}</em> with the
values for your user pool. </p>
</li>
<li class="li">Under ATTRIBUTE STATEMENTS (OPTIONAL), add a statement with the
following information:
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_kjj_34k_1gc__table_cpf_tzw_zfc" rules="all" summary="">
<colgroup>
<col>
<col>
</colgroup>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align:top;"><strong class="ph b">SAML attribute Name</strong></td>
<td class="entry cell-norowborder" style="vertical-align:top;"><strong class="ph b">Value</strong></td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" style="vertical-align:top;">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</td>
<td class="entry cellrowborder" style="vertical-align:top;">user.email.</td>
</tr>
</tbody>
</table>
</div>
</li>
<li class="li">Leave the other settings as their default values or set them
according to your preferences.</li>
</ul>
</li>
<li class="li">Click <strong class="ph b">Next</strong>, then click <strong class="ph b">Finish</strong>.</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested2" id="topic_zwj_34k_1gc">
<h3 class="title topictitle3" id="ariaid-title6">Step 3: Assign users to your application</h3>
<div class="body">
<p class="p">In this step, you'll assign users to the application you created in step 1. </p>
<p class="p"><strong class="ph b">To assign users to your application</strong></p>
<ol class="ol" id="topic_zwj_34k_1gc__ol_ksl_4vk_1gc">
<li class="li">On the Assignments tab for your Okta app, under Assign, select <strong class="ph b">Assign to
People</strong>. </li>
<li class="li">Click <strong class="ph b">Assign</strong> next to the user that you want to assign. </li>
<li class="li">Click <strong class="ph b">Save</strong>, then click <strong class="ph b">Go back</strong>.<p class="p">Your user is now assigned.
</p>
</li>
<li class="li">Click <strong class="ph b">Done</strong>.</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested1" id="topic_imk_34k_1gc">
<h2 class="title topictitle2" id="ariaid-title7">Step 4: Specify the identity provider to be used for agent authentication</h2>
<div class="body">
<p class="p">In this step, you'll add an identity provider to authenticate your agents.</p>
<p class="p"><strong class="ph b">To specify the identity provider</strong></p>
<ol class="ol" id="topic_imk_34k_1gc__ol_pnf_wxk_1gc">
<li class="li">On the sign on tab for your Okta app, find the identity provider metadata
hyperlink, then right-click the hyperlink and copy it.</li>
<li class="li">Sign in to the AWS account containing the Cognito userpool. </li>
<li class="li">Navigate to Cognito and open the userpool.</li>
<li class="li">Click the Sign-in experience tab, then click <strong class="ph b">Add identity
provider</strong>.<p class="p"><img class="image" id="topic_imk_34k_1gc__image_vm3_bg2_1gc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/LM_cc_3.png" width="550"></p>
</li>
<li class="li">On the resulting page, select <strong class="ph b">SAML</strong>.</li>
<li class="li">Under Set up SAML federation with this user pool, do the following:<ul class="ul" id="topic_imk_34k_1gc__ul_gpf_tzw_zfc">
<li class="li">
<strong class="ph b">Provider name</strong>: Enter a name for the identity provider without
using any spaces in the name.</li>
<li class="li">
<strong class="ph b">Metadata document source</strong>: Paste the Metadata URL from the
previous step in the metadata endpoint URL field.</li>
</ul>
</li>
<li class="li">Under Map attributes between your SAML provider and your user pool, set the
following attribute:
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_imk_34k_1gc__table_hpf_tzw_zfc" rules="all" summary="">
<colgroup>
<col>
<col>
</colgroup>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align:top;"><strong class="ph b">User pool attribute</strong></td>
<td class="entry cell-norowborder" style="vertical-align:top;"><strong class="ph b">SAML attribute</strong></td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" style="vertical-align:top;">email</td>
<td class="entry cellrowborder" style="vertical-align:top;">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</td>
</tr>
</tbody>
</table>
</div>
</li>
<li class="li">Click <strong class="ph b">Add identity provider</strong>. <p class="p">At this point the required identity
provider has been created. The last step in the Cognito configuration is to
specify that the app client must use this identity provider.</p>
</li>
<li class="li">Click the <strong class="ph b">App integration</strong> tab, then click <strong class="ph b">app-client</strong> at the bottom
of the page. </li>
<li class="li">In the app-client, in the Hosted UI section, click <strong class="ph b">Edit</strong>.<p class="p"><img class="image" id="topic_imk_34k_1gc__image_xlm_cg2_1gc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/LM_cc_4.png" width="550"></p>
</li>
<li class="li">Under Hosted sign-up and sign-in pages, click <strong class="ph b">Identity providers</strong>, then
select the identity provider that you configured in the previous step. </li>
<li class="li">Click <strong class="ph b">Save changes</strong>.</li>
</ol>
<p class="p">You'll need the name of the IDP (as configured under Sign-in experience) to complete
the setup of your account. Include this along with the CloudFormation outputs
information shared with Zendesk.</p>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/9459046854938-Setting-up-Okta-single-sign-on-for-Contact-Center",
"url": "https://support.zendesk.com/hc/en-us/articles/9459046854938-Setting-up-Okta-single-sign-on-for-Contact-Center",
"headline": "Setting up Okta single sign-on for Contact Center",
"description": "You can set up Okta single sign-on for your Contact Center by creating and configuring a SAML application in Okta, assigning users, and specifying the identity provider for agent authentication to manage access securely.",
"articleSection": "Setting up Contact Center",
"datePublished": "2025-07-07T17:54:30+00:00",
"dateModified": "2026-04-09T23:15:31+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/9459046854938-Setting-up-Okta-single-sign-on-for-Contact-Center"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com",
"softwareAddOn": {
"@type": "SoftwareApplication",
"name": "Contact Center",
"@id": "https://support.zendesk.com/hc/en-us/sections/9248688983706"
}
}
}</script><script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>