Already a NinjaOne customer? Log in to view more guides and the latest updates.

NinjaOne Identity Access Management (IAM): About IDP-Initiated Security Assertion Markup Language (SAML)

  • Last Updated October 23, 2026

Topic

This article explains how to enable an identity provider (IdP)- initiated login with the Security Assertion Markup Language (SAML) for NinjaOne.

Environment

NinjaOne Identity Access Management (IAM)

Description

IDP-initiated SAML login is supported by NinjaOne. There are a few things to consider when enabling this option.

  • IDP-initiated SAML: This is a new option offered by NinjaOne. You can use an IdP (whether via an icon from an Application Catalog or a direct link) to log in to NinjaOne. Your IdP may or may not require multi-factor authentication (MFA), based on the NinjaOne Platform: Enable Conditional NinjaOne Multifactor Authentication Bypass configuration.
  • SP-initiated SAML: This option was previously supported by NinjaOne. You would access NinjaOne first and be redirected to your IdP to login, and then you would navigate back to NinjaOne.

By default, IDP-initiated SAML is deactivated for existing and new NinjaOne IdP configurations. To perform IDP-initiated logins, activate the Enable IdP-initiated login toggle when configuring your IdP. When this option is deactivated, and you attempt an IDP-initiated login, you will see a generic error on the login page. Submit the Incident ID to NinjaOne Support to resolve the specific reason for the error.

IDP_enable saml validation.png
Figure 1: Enable IdP-initiated login (click to enlarge)

Index

Select a topic to continue.

Create a New Unique Identifier for Identity Provider Configurations

When configuring a new IdP in NinjaOne, you will see a new Unique identifier included. The purpose of this Unique identifier is to allow the creation of new NinjaOne from different divisions in the same IdP (if you have multiple divisions). The Unique identifier will always be the same for the same division. It will be included at the end of the SP identifier and Reply URL.

Any existing IdP configurations created prior to release 10.0.0 will not use a Unique identifier and will continue to work as before. Only newly created IdPs will include the Unique identifier. If you need a Unique identifier included in an existing IdP configuration, you must remove and recreate the configuration.
IDP_unique id.png
Figure 2: Unique identifier inclusion example

IDP-initiated SAML Configuration for Branded Divisions

If you want the IDP-initiated login to use a branded URL, set up your IdP application configuration to use the branded Assertion Consumer Service (ACS) URL as the default. You can use the following categories for guidance: 

Configuring a Branded URL for IDP-initiated in Entra

For the Reply URL (Assertion Consumer Service URL) in Azure, configure the URL you want IDP-initiated logins to land on to be the default. We recommend that you configure both the native and branded ACS URLs to support SP-initiated requests from both starting points. 

azure saml config.png
Figure 3: Basic SAML configuration for Azure example → Reply URL

SAML Encryption

With Security Assertion Markup Language (SAML) encryption, you can transform your SSO assertion data so it is protected from unauthorized access. This creates a high-trust relationship between your identity provider (IdP) and NinjaOne.

At this time, SAML encryption is not activated by default for our Commercial instance. Please contact your Account Manager to activate this feature. SAML encryption expires after one year in NinjaOne.
To use SAML encryption, set up your IdP using the steps provided in NinjaOne Identity Access Management (IAM): Resource Catalog for SSO, SAML, and SCIM. If you are setting up the IdP for Okta, you must use the Okta custom SAML application. You cannot use the app in the Okta integration network app store.
  1. After you have configured the General settings and optional MFA bypass, open the Advanced section of the Configure SSO dialog and activate the Require signed assertions and responses toggle.
require signed assertions and responses.png
Figure 4: Advanced settings → Require signed assertions and responses
  1. Select your Minimum signature algorithm and Minimum digest algorithm from the drop-down menus to increase the complexity required when processing the IdP signatures. NinjaOne will accept any traffic coming from the selected signature or digest algorithm or higher.
  2. Activate the Require encrypted assertions toggle, and then select your algorithms and key length settings from the associated drop-down menus. We suggest selecting the minimum settings for what you need.
require encrypted assertions.png
Figure 5: Advanced settings → Require encrypted assertions
  1. Click Generate certificate. Copy the contents of the certificate or download the PEM file if your IdP accepts them.
  2. Navigate to your IdP site and log in. Upload the certificate PEM file or paste the copied data.
  3. Test the connection in NinjaOne.
  4. Click Save.

If your encryption expires, you can select Manage encryption certificate from the actions menu to renew it.

manage encryption certificate.png
Figure 6: Manage encryption certificate (click to enlarge)

Additional Resources

To learn more about NinjaOne's identity services, refer to Identity Authentication and Management: Resource Catalog.

To learn more about enabling SAML for Okta, refer to Configuring NinjaOne SAML in Okta.

FAQ

Next Steps