Configure single sign-on with Azure Active Directory
Global Administrator role in Azure Active Directory is required.
You can configure identity federation in your Nintex Workflow Cloud tenant using Azure Active Directory, which has single sign-on Enables users to access multiple applications using one set of credentials. by default.
With single sign-on enabled, users can securely and conveniently sign in to Nintex Workflow Cloud with their Azure Active Directory accounts.
- Enabling single sign-on in your tenancy will also enable single sign-on in any other Nintex Workflow Cloud tenancies associated with the federated email domain. For example, both sales.workflowcloud.com and hr.workflowcloud.com will be enabled with single sign-on if you federate using Azure Active Directory.
- If you want to configure single sign-on using SAML protocol, see Configure single sign-on using SAML protocol.
Prerequisites for Azure Active Directory identity federation
- To connect Azure Active Directory and Nintex Workflow Cloud, Azure Active Directory requires that a global administrator provides consent on behalf of the organization to connect their system to Nintex.
- The Nintex Workflow Cloud user email address and the Azure Active Directory global administrator email address must be the same in order to provide continuity between both systems.
Note: For users to receive emails from Nintex Workflow Cloud, a valid email address must be provided. If the email attribute of a user account is not set, the UPN attribute of the user account must have a value, which must be a valid email address.
Configure Azure Active Directory identity federation
The following steps establish a connection between the specified Nintex Workflow Cloud domain and an Azure Active Directory domain. If the Azure Active Directory has more than one email domain, you can add additional domains from the Domain management page.
In Nintex Workflow Cloud:
- Access the User management page:
- Click Settings.
- Click User management.
- Under Identity federation, click Configure.
- Select Azure Active Directory as the identity provider.
- Click Next.
The setup wizard appears.
-
To start the consent flow between the Nintex Identity Management Service Nintex service which facilities single-sign on capabilities across the Nintex platform, meaning users have one username and password to access multiple Nintex products. and Azure Active Directory click Initiate connection.
- You are prompted to log into your Azure Active Directory. You are redirected to an Azure Active Directory screen and prompted to give consent for the Nintex Authentication Platform to:
- Read directory data
- Sign in and read user profiles
- Click Accept.
If the connection request is successful, users of Nintex Workflow Cloud tenancies associated with the federated email domain can use their Azure Active Directory credentials to sign-in and authenticate. You can now invite additional users in the Azure Active Directory into the tenancy from the User management page.

Page | Section | User interface element |
Description |
||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Identity provider type | Warning message |
A warning message appears, listing the tenants that are associated with your tenant. Note:
Enabling single sign-on in your tenant will also enable single sign-on in associated Nintex Workflow Cloud tenants. For example, both sales-myorg.workflowcloud.com and hr-myorg.workflowcloud.com will be enabled with single sign-on if you configure SAML in either of them. |
|||||||||||||||||||||||||||||||||||
Select single sign-on (SSO) type |
Select the means to enable SSO in your Nintex Workflow Cloud tenant.
|
||||||||||||||||||||||||||||||||||||
Verify Domain (This page displays only when you select SAML for Single sign-on (SSO) type) |
DNS record |
The code to use as a value in your DNS record. For the domain verification steps, see Verify a domain for SAML configuration. Caution: As part of the prerequisites to Federation configuration, you must first verify ownership over a domain that you're going to use for SAML configuration. If you have not verified your domain or while your DNS is still processing the verification, you can continue configuring SAML in Nintex Workflow Cloud but you cannot submit your SAML configuration. |
|||||||||||||||||||||||||||||||||||
![]() |
Click to copy the code. | ||||||||||||||||||||||||||||||||||||
Configure Identity Provider (This page displays only when you select SAML for Single sign-on (SSO) type) |
Choose Identity Provider | Identity provider |
Displays the list of identity providers you can use for your tenant's identity federation. |
||||||||||||||||||||||||||||||||||
Service Provider data |
|
(Appears after you select an identity provider) In the context of our SAML configuration, the service provider is Nintex Workflow Cloud. Depending on the identity provider you choose, the SAML terminologies displayed in this section correspond with what your identity provider uses. ![]()
|
|||||||||||||||||||||||||||||||||||
Attributes |
Set of identity data about a user. In configuring SAML in Nintex Workflow Cloud, only three attributes are requested from the identity provider:
|
||||||||||||||||||||||||||||||||||||
![]() |
Click to copy the values in the fields. | ||||||||||||||||||||||||||||||||||||
Connect (This page displays only when you select SAML for Single sign-on (SSO) type) |
URL |
Location of the SAML metadata An XML document that contains information about a SAML deployment.. |
|||||||||||||||||||||||||||||||||||
Upload metadata | The SAML metadata file. | ||||||||||||||||||||||||||||||||||||
Complete |
<Date> |
(Only displayed for SAML) Expiry date of the certificate. |
|||||||||||||||||||||||||||||||||||
<Email address> |
(Only displayed for SAML) Email address to receive reminder when certificate is soon to expire. |
||||||||||||||||||||||||||||||||||||
One-Time Password (OTP) URL | <URL> |
The One-Time Password (OTP) URL is used for troubleshooting purposes when configuration fails and you are locked out of your tenant. Follow these steps to access your tenant when you cannot sign in due to a failed configuration of SAML:
The Sign in page of Nintex Workflow Cloud appears. For verification, a one-time password is sent to your email address. Note: The one-time password expires after five minutes. You can access your Nintex Workflow Cloud tenant and resume configuring your identity federation. |