Configuring Contact Center SSO with Azure AD

<body>
<p id="docs-hc-snippet" style="display: none;">Both Amazon Connect and Zendesk Contact Center can be configured for SSO with Microsoft Azure Active Directory (Azure AD) as the SAML-based identity provider. Amazon Connect and Contact Center each require a SAML application. The required SAML applications are created and configured in the Azure AD portal.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="addon_contact-center">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Contact Center</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Configure Single Sign-On (SSO) with Azure AD for your Contact Center to streamline user access and enhance security. Set up involves creating a SAML application in Azure AD, configuring an identity provider in the Cognito Userpool, and specifying it for agent authentication. This integration simplifies login processes and centralizes user management across platforms.</p>
</div>

<div class="body">

<p class="p" dir="ltr">Both Amazon Connect and Zendesk Contact Center can be configured for SSO with
Microsoft Azure Active Directory (Azure AD) as the SAML-based identity provider. Amazon
Connect and Contact Center each require a SAML application. The required SAML
applications are created and configured in the Azure AD portal.</p>
<p class="p" dir="ltr">The Azure AD AWS SAML application along with an AWS IAM identity provider will
enable the federation between Azure AD and your AWS IAM users.</p>
<p class="p">This article contains the following topics:</p>
<ul class="ul" id="rjs1__ul_rc2_t1x_qgc">
<li class="li"><a class="xref" href="#topic_pg5_41x_qgc">Configuring SSO for Amazon Connect</a></li>
<li class="li"><a class="xref" href="#topic_ufh_p1x_qgc">Configuring SSO for Contact Center</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_pg5_41x_qgc">
<h2 class="title topictitle2" id="ariaid-title2">Configuring SSO for Amazon Connect</h2>
<div class="body">
<p class="p" dir="ltr">You can configure Amazon Connect SSO with Azure AD as described in this
<a class="xref" href="https://catalog.workshops.aws/amazon-connect-sso/en-US/3-sso-amazonconnect-azuread" target="_blank">Configure Single Sign-On for Amazon Connect Using
Azure AD</a> in the AWS documentation.</p>
<p class="p" dir="ltr">It's a good idea to use Service Control Policies (SCPs) to manage
permissions regarding what users and roles can do in Amazon Connect, protecting
important resources and making your system more secure. See<a class="xref" href="https://docs.aws.amazon.com/connect/latest/adminguide/security-best-practices.html" target="_blank">Security best practices for Amazon
Connect</a>.</p>
<p class="p" dir="ltr">The following example SCP can be used to prevent the deletion of the Amazon
Connect instance and associated role.</p>
<pre class="pre">&lt;pre&gt;&lt;code class="language-json"&gt;
&amp;lt;pre&amp;gt;&amp;lt;code class=&amp;quot;language-json&amp;quot;&amp;gt;
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonConnectRoleDenyDeletion",
"Effect": "Deny",
"Action": [
"iam:DeleteRole"
],
"Resource": [
"arn:aws:iam::*:role/***Amazon Connect user role***"
]
},
{
"Sid": "AmazonConnectInstanceDenyDeletion",
"Effect": "Deny",
"Action": [
"connect:DeleteInstance"
],
"Resource": [
"***Amazon Connect instance ARN***"
]
}
]
}
&amp;lt;/pre&amp;gt;&amp;lt;/code&amp;gt;
&lt;/pre&gt;&lt;/code&gt;
</pre>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_ufh_p1x_qgc">
<h2 class="title topictitle2" id="ariaid-title3">Configuring SSO for Contact Center</h2>
<div class="body">
<p class="p" dir="ltr">Single Sign On (SSO) for Contact Center is implemented by configuring the
Cognito Userpool to use a SAML application for sign-in. The Cognito Userpool is the
one which was created by the Contact Center CloudFormation template.</p>
<p class="p" dir="ltr">The high-level process includes:</p>
<ol class="ol" id="topic_ufh_p1x_qgc__ol_vpj_yxg_pgc">
<li class="li" dir="ltr">Gather the required Cognito Userpool details.</li>
<li class="li" dir="ltr">Create the SAML application in the Azure AD portal.</li>
<li class="li" dir="ltr">Configure an identity provider in the Cognito Userpool.</li>
<li class="li" dir="ltr">Specify this identity provider to be used for agent
authentication.</li>
</ol>
<p class="p"><strong class="ph b">To gather the required Cognito Userpool details</strong></p>
<ol class="ol" id="topic_ufh_p1x_qgc__ol_qkn_cbx_qgc">
<li class="li">Log in to the AWS account where the Contact Center CloudFormation stack was
created. </li>
<li class="li">Navigate to the Cognito service (ensure that you are in the correct region) and
open the Userpool which was created when the Contact Center CloudFormation stack
was created. <p class="p">Take note of the Userpool ID.</p>
<p class="p" dir="ltr"><img class="image" id="topic_ufh_p1x_qgc__image_yl2_zfw_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_ad_1.png" width="700"></p>
</li>
<li class="li">Click the App integration tab and note down the Cognito domain prefix. <p class="p">This
is the first part of the Cognito domain, before the '.auth.regionxxx'. This
is also the value that was specified in the CloudFormation template so can
be copied from the CloudFormation parameters tab if you prefer.</p>
</li>
</ol>
<p class="p"><strong class="ph b">To create the SAML application in the Azure AD portal</strong></p>
<ol class="ol" id="topic_ufh_p1x_qgc__ol_z23_3bx_qgc">
<li class="li">Sign in to the Azure Portal and in the Azure Service section, select Azure
Active Directory. </li>
<li class="li">In the left sidebar, select <strong class="ph b">Enterprise applications</strong>. </li>
<li class="li">Click <strong class="ph b">New application</strong> and then <strong class="ph b">Create your own application</strong>. </li>
<li class="li">Complete the <strong class="ph b">Input name</strong> field.<ol class="ol" id="topic_ufh_p1x_qgc__ol_rx4_qjm_tgc" type="a">
<li class="li">Enter a name for your application. For example, Zendesk Contact Center
production. </li>
<li class="li">Select <strong class="ph b">Integrate any other application you don’t find in the gallery
(Non-gallery)</strong>. </li>
<li class="li">Click <strong class="ph b">Create</strong>.</li>
</ol>
<p class="p" dir="ltr"><img class="image" id="topic_ufh_p1x_qgc__image_scq_1gw_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_ad_2.png" width="750"></p>
<p class="p" dir="ltr">It takes a few
seconds for the application to be created in Azure AD, then you're
redirected to the overview page for the newly added application.</p>
</li>
</ol>
<p class="p"><strong class="ph b">To set up Single Sign-on using SAML</strong></p>
<ol class="ol" id="topic_ufh_p1x_qgc__ol_n13_nbx_qgc">
<li class="li">On the Getting started page, in the Set up single sign on tile, click <strong class="ph b">Get
started</strong>. <p class="p" dir="ltr"><img class="image" id="topic_ufh_p1x_qgc__image_fzc_cgw_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_ad_3.png" width="650"></p>
</li>
<li class="li">On the next screen, select SAML.</li>
<li class="li">In the middle pane, under Set up Single Sign-On with SAML, in the Basic SAML
configuration section, click the edit icon.</li>
<li class="li">Navigate to the middle pane under Set up Single Sign-On with SAML.</li>
<li class="li">In the User Attributes &amp; Claims section, click <strong class="ph b">Edit</strong>.</li>
<li class="li">Enter the following field values:<ul class="ul" id="topic_ufh_p1x_qgc__ul_dqj_yxg_pgc">
<li class="li" dir="ltr">
<strong class="ph b">Identifier (Entity ID):</strong> urn:amazon:cognito:sp:<strong class="ph b">${pool
ID}</strong>
</li>
<li class="li" dir="ltr">
<strong class="ph b">Reply URL (Assertion Consumer Service URL):
</strong>https://<strong class="ph b">${DomainPrefix}</strong>.auth.<strong class="ph b">${RegionID}</strong>.amazoncognito.com/saml2/idpresponse</li>
<li class="li">[.callout-primary--alert-message]</li>
</ul>
<p class="p" dir="ltr">Replace the above placeholders with the values copied from the
Cognito Userpool.</p>
<p class="p" dir="ltr"><img class="image" id="topic_ufh_p1x_qgc__image_jyn_dgw_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_ad_4.png" width="750"></p>
</li>
<li class="li">Click <strong class="ph b">Add a group claim</strong>. </li>
<li class="li">On the User attributes &amp; claims page, in the right pane under Group claims,
select <strong class="ph b">Groups assigned to the application</strong>. <p class="p">Leave Source attribute as
Group ID.</p>
<p class="p" dir="ltr"><img class="image" id="topic_ufh_p1x_qgc__image_ygz_2gw_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_ad_5.png" width="650"></p>
</li>
<li class="li">Click <strong class="ph b">Save</strong>.</li>
<li class="li">Close the User attributes &amp; claims page.<p class="p">You’re redirected to the Set up
single sign-on with SAML page.</p>
</li>
<li class="li">Scroll down to the SAML signing certificate section, and copy the app federation
metadata URL by choosing the copy into clipboard icon. <p class="p">Keep this URL handy as
you’ll need it in the next step.</p>
<p class="p" dir="ltr"><img class="image" id="topic_ufh_p1x_qgc__image_vw2_ggw_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_ad_6.png" width="550"></p>
</li>
</ol>
<p class="p"><strong class="ph b">To configure an identity provider in the Cognito Userpool</strong></p>
<ol class="ol" id="topic_ufh_p1x_qgc__ol_wbd_tbx_qgc">
<li class="li">Sign into the AWS account which contains the Cognito Userpool.</li>
<li class="li">Navigate to Cognito and open the Userpool.</li>
<li class="li">Select the Sign-in experience tab and then click <strong class="ph b">Add identity provider</strong>.<p class="p" dir="ltr"><img class="image" id="topic_ufh_p1x_qgc__image_u1l_hgw_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_ad_7.png" width="650"></p>
</li>
<li class="li">On the next page, select SAML.</li>
<li class="li">Under Set up SAML federation with this user pool, configure the following:<ul class="ul" id="topic_ufh_p1x_qgc__ul_jqj_yxg_pgc">
<li class="li" dir="ltr">
<strong class="ph b">Provider name:</strong> Enter a name for this identity provider.
It is recommended to not use any spaces in the name.</li>
<li class="li" dir="ltr">
<strong class="ph b">Metadata document source:</strong> Paste the metadata URL, from
the previous step, in the metadata endpoint URL field.</li>
</ul>
</li>
<li class="li">Under Map attributes between your SAML provider and your user pool, set the
following attribute:
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_ufh_p1x_qgc__table_kqj_yxg_pgc" rules="all" summary="">
<colgroup>
<col>
<col>
</colgroup>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" dir="ltr" style="vertical-align:top;"><strong class="ph b">User pool attribute</strong></td>
<td class="entry cell-norowborder" dir="ltr" style="vertical-align:top;"><strong class="ph b">SAML attribute</strong></td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" dir="ltr" style="vertical-align:top;">email</td>
<td class="entry cellrowborder" dir="ltr" style="vertical-align:top;">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</td>
</tr>
</tbody>
</table>
</div>
</li>
<li class="li">Click <strong class="ph b">Add identity provider</strong>. <p class="p" dir="ltr">At this point the required
identity provider has been created. The last step in the Cognito
configuration is to specify that the app client will use this identity
provider for agent authentication. </p>
</li>
</ol>
<p class="p"><strong class="ph b">To specify the identity provider to be used for agent authentication</strong></p>
<ol class="ol" id="topic_ufh_p1x_qgc__ol_bbv_vbx_qgc">
<li class="li">Select App integration from the tabbed view, scroll to the bottom and click
<strong class="ph b">app-client</strong>.</li>
<li class="li">Scroll down to the Hosted UI section and click <strong class="ph b">Edit</strong>.<p class="p" dir="ltr"><img class="image" id="topic_ufh_p1x_qgc__image_f2h_3gw_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_ad_8.png" width="700"></p>
</li>
<li class="li">Under Hosted sign-up and sign-in pages scroll down to the Identity providers
dropdown list, then select the identity provider that was configured in the
previous step. </li>
<li class="li">Click <strong class="ph b">Save changes</strong>.<p class="p">Zendesk requires the name of the IDP (as configured
under Sign-in experience) to complete the setup of your account. Include
this along with the CloudFormation outputs in the information you share with
Zendesk.</p>
</li>
</ol>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/9696124990106-Configuring-Contact-Center-SSO-with-Azure-AD",
"url": "https://support.zendesk.com/hc/en-us/articles/9696124990106-Configuring-Contact-Center-SSO-with-Azure-AD",
"headline": "Configuring Contact Center SSO with Azure AD",
"description": "You can configure Single Sign-On (SSO) for Contact Center and Amazon Connect using Azure Active Directory as the SAML identity provider by setting up SAML applications and configuring identity providers in Cognito Userpools.",
"articleSection": "Setting up Contact Center",
"datePublished": "2025-09-09T20:14:24+00:00",
"dateModified": "2026-04-15T20:14:14.366325+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/9696124990106-Configuring-Contact-Center-SSO-with-Azure-AD"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>