Test Mode

Before you can turn on single sign-on (SSO) for your organization, you must use test mode to confirm that users can sign in to Blackbaud solutions through your identity provider (IdP). Test mode is enabled after you save your SSO configuration settings, and a special URL — https://app.blackbaud.com/signin/?ssoTest=true — lets users access a test sign-in that sends Blackbaud IDs with your claimed email domains to your IdP.

Users at your organization who sign in through test mode automatically use it again the next time they sign in. All other users continue to use their usual sign-in URL and their existing authentication method until you turn on SSO.

To troubleshoot issues during test mode, see our SSO Frequently Asked Questions.

  1. In Security, select Authentication.

  2. Under Single sign-on, select Manage SSO settings.

  3. If you haven't started setting up SSO, select your SSO method. For details, see Single Sign-on Setup.

    1. Under Claim your email domains, select Claim domains or Edit claimed domains and specify your email domains.

    2. Under Configure your connection, select Get started or Edit connection and configure the connection.

      When you save your configuration settings, test mode is turned on automatically.

      For Azure AD, you can test your connection immediately, but for Google Workspace, OIDC, and SAML 2.0, configuration changes can take up to 30 minutes to take effect, so we recommend waiting 30 minutes before you test your SSO connection.

  4. Under Test connection, select Learn about test connection to access test mode URLs.

    • Under Blackbaud ID redirect, you can copy the URL — https://app.blackbaud.com/signin/?ssoTest=true — for a test sign-in that sends Blackbaud IDs with a claimed email domain to your IdP.

    • Under Automatic ID redirect, you can copy a URL that automatically sends users straight to your IdP instead of routing them through Blackbaud's sign-in page.

  5. Share the test mode URL with the users who will test your connection, and instruct them to sign in through a in a private or incognito browser.

    Warning: To avoid sign-in errors and possible lockout while using test mode, users who are testing the connection must sign in through the test mode URL before they sign in to Blackbaud solutions. This is only necessary until you turn off test mode or turn on the SSO connection.

    Note: If a consent screen appears in test mode, then that means your IdP is configured to require admin approval before users authenticate. This consent screen is for the Blackbaud SSO application and is not requesting new permissions or access. It is seeking read-access to the user information that you already configured as part of your SSO setup. To proceed, follow the instructions on your IdP's consent screen.

  6. After at least one user successfully signs in using test mode, you can enable your SSO connection by selecting Turn on SSO under Turn on.

You can turn off test mode as necessary, but this should only be necessary if you need to change your configuration settings before enabling SSO or if you anticipate a long delay and want to revert the users who signed in through test mode to use another authentication method until you are ready to enable SSO. When you turn off test mode, your connection settings remain saved so that you can easily turn on test mode again. Users who signed in through your test connection revert to their previous authentication method, and if they use Blackbaud's secure authentication service, they receive an email to reset their passwords.

To turn off test mode, go to the Authentication settings page and select Turn off Test mode under Test connection. On the Turn off Test mode screen, select Turn off Test mode.