Skip to main content

Single Sign-On (SSO) Overview

Enable users to access NetSuite using their corporate identity provider credentials.

What is SSO?​

Single Sign-On allows users to authenticate once with their identity provider (IdP) and access NetSuite without entering separate credentials.

SSO AUTHENTICATION FLOW
═══════════════════════════════════════════════════════════════════════════════

   USER                    IDENTITY PROVIDER              NETSUITE
   ────                    ─────────────────              ────────

     │                            │                           │
     │  1. Access NetSuite        │                           │
     │ ────────────────────────────────────────────────────▶ │
     │                            │                           │
     │                            │  2. Redirect to IdP       │
     │ ◀──────────────────────────────────────────────────── │
     │                            │                           │
     │  3. Authenticate           │                           │
     │ ──────────────────────────▶│                           │
     │                            │                           │
     │  4. SAML Assertion         │                           │
     │ ◀──────────────────────────│                           │
     │                            │                           │
     │  5. Submit Assertion       │                           │
     │ ────────────────────────────────────────────────────▶ │
     │                            │                           │
     │  6. Access Granted         │                           │
     │ ◀──────────────────────────────────────────────────── │
     │                            │                           │

Supported Identity Providers​

ProviderProtocolGuide
Microsoft Entra ID (Azure AD)SAML 2.0Setup Guide
Google WorkspaceSAML 2.0Setup Guide
OktaSAML 2.0Coming soon
OneLoginSAML 2.0Coming soon

Prerequisites​

NetSuite Requirements​

RequirementDetails
NetSuite EditionAny edition with SuiteCloud
RoleAdministrator or Full Access
FeatureSAML Single Sign-on (enabled)
User RecordsMust have matching email addresses

Identity Provider Requirements​

RequirementDetails
Admin AccessAbility to create enterprise applications
User AccountsUsers must exist in IdP
Email MatchIdP email must match NetSuite email

Enable SAML SSO Feature​

Before configuring any SSO provider, enable the feature in NetSuite:

Step 1: Enable Feature​

  1. Navigate to Setup > Company > Enable Features
  2. Go to SuiteCloud subtab
  3. Check SAML Single Sign-on
  4. Click Save

Step 2: Access SSO Configuration​

  1. Navigate to Setup > Integration > SAML Single Sign-on
  2. This is where you'll configure your IdP settings

Key Concepts​

SAML 2.0 Terminology​

TermDescription
Service Provider (SP)NetSuite - the application users want to access
Identity Provider (IdP)Entra ID/Google - authenticates the user
SAML AssertionXML document proving user identity
Entity IDUnique identifier for NetSuite instance
ACS URLWhere IdP sends the SAML response
MetadataXML describing SP/IdP configuration

NetSuite SAML Endpoints​

EndpointURL Pattern
Entity IDhttps://system.netsuite.com/saml2/sp/{ACCOUNT_ID}/acs
ACS URLhttps://system.netsuite.com/saml2/sp/{ACCOUNT_ID}/acs
Metadatahttps://system.netsuite.com/saml2/sp/{ACCOUNT_ID}/metadata

Replace {ACCOUNT_ID} with your NetSuite account ID (e.g., 1234567).

User Matching​

How NetSuite Matches Users​

USER MATCHING FLOW
═══════════════════════════════════════════════════════════════════════════════

IdP User                                    NetSuite User
────────                                    ─────────────

┌─────────────────────┐                    ┌─────────────────────┐
│                     │                    │                     │
│  Email:             │                    │  Email:             │
│  john@company.com   │ ─────MATCH─────▶  │  john@company.com   │
│                     │                    │                     │
│  Name ID Claim      │                    │  Employee/Contact   │
│                     │                    │  Record             │
└─────────────────────┘                    └─────────────────────┘

MATCHING RULES:
1. IdP sends email as Name ID claim
2. NetSuite searches for user with matching email
3. If found → user logs in with their NetSuite roles
4. If not found → login fails (user not provisioned)

Best Practices for User Matching​

PracticeBenefit
Use email as Name IDConsistent matching
Sync email addressesPrevent login failures
Provision users firstUsers must exist in NetSuite
Case-insensitive matchingNetSuite matches case-insensitively

SSO vs Traditional Login​

FeatureTraditional LoginSSO
Password managementNetSuite passwordsCorporate IdP
Multi-factor authNetSuite MFAIdP MFA
Password policiesNetSuite policiesIdP policies
ProvisioningManualCan automate with SCIM
Access revocationDisable in NetSuiteDisable in IdP
User experienceSeparate loginSingle login

Security Considerations​

Certificate Management​

AspectRecommendation
Certificate rotationPlan for annual renewal
AlgorithmUse SHA-256 minimum
BackupKeep certificate backups
Expiry monitoringSet reminders before expiry

Access Control​

ControlImplementation
IP restrictionsCan still use NetSuite IP rules
Role assignmentManual or via SCIM
Session timeoutControlled by NetSuite
LoggingAudit SSO events

Troubleshooting Overview​

Common Issues​

IssueLikely CauseSolution
User not foundEmail mismatchVerify emails match
Invalid signatureCertificate issueRe-upload IdP certificate
Clock skewTime differenceSync server clocks
ACS URL mismatchWrong URL in IdPVerify ACS URL
Not authenticatedIdP session expiredRe-authenticate at IdP

Where to Check​

LocationWhat to Look For
NetSuite Login AuditSSO login attempts
IdP Audit LogsAuthentication events
Browser Developer ToolsSAML response
SAML Tracer (browser extension)Full SAML flow

Next Steps​

Choose your identity provider guide: