Single Sign-on (SSO) Connection

Turn On SSO

After you configure your connection, you can turn on SSO to enable users to sign in through your identity provider (IdP). Users with emails on your claimed domains are then redirected to your IdP when they sign in with their Blackbaud IDs. After they authenticate through your IdP, their Blackbaud IDs:

• Automatically redirect to your organization's login for future sign-ins

• Use your IdP for password updates, lockouts, and other authentication management

Make sure to resend any pending invitations that were sent before you turned on SSO. To configure your SSO connection, see our instructions for setting it up with Microsoft Entra AD, Google Workspace, OpenID Connect (OIDC), or SAML 2.0.

Turn Off SSO

On the Single sign-on page, you can turn off your SSO connection as necessary. For example, you can turn it off while you troubleshoot an issue or change the connection method. After you turn off SSO:

• Your organization's users will receive an email to reset their passwords to sign in through Blackbaud's secure authentication service. They can opt to sign in through social sign-in if they prefer.

• You can still use your SSO connection in test mode to verify and manage settings.

To turn off your SSO connection:

1. On the Single sign-on page, select Turn off SSO.

2. On the Turn off SSO connection screen, select the Turn off your SSO connection checkbox.

3. If you don't want to prompt users to reset their passwords, clear the Send users an email to reset their Blackbaud ID passwords checkbox. By default, the option emails all users who sign in through your SSO connection, and you should only clear it if you will turn SSO back on before users need to sign in. For example, you can clear it for small changes, such as switching your IdP, where users won't reset their passwords because you will turn SSO back on relatively quickly.

4. Select Turn off SSO.