Brief Overview

An Identity Provider (IDP) is a service that stores and manages digital identities. When integrated with WalkMe, your IDP becomes the single source of truth for user identification — replacing the need to define a unique user ID for each system separately.

IDP Integration lets you:

• Validate user identity through your organization's existing authentication flow
• Enrich content segmentation using IDP attributes like region, department, or role
• Ensure consistent, accurate user behavior data across all systems

For any new system, IDP Integration is the recommended approach to user identification.

Use Cases

• Require IDP authentication before showing WalkMe content to users
• Segment content by IDP attributes such as department, region, or user role
• Maintain accurate analytics across multiple systems using a single, reliable user identifier

Access

To access IDP Integration in the console:

1. Open the WalkMe Console:
   
   • US Data Center
   • EU Data Center
   • SAP US Data Center
   • SAP EU Data Center
   • FedRAMP Data Center
   • Canada Data Center
2. Go to the Admin category
3. Select Security & Audit, then IDP Integration

To access IDP Integration in the Admin Center:

1. Open the WalkMe Admin Center:
   
   • US Data Center
   • EU Data Center
   • SAP US Data Center
   • SAP EU Data Center
   • FedRAMP Data Center
   • Canada Data Center
2. Go to the IDP Integration page

Supported Protocols and Vendors

WalkMe IDP Integration supports three authentication protocols:

1. OAuth 2.0: The industry-standard protocol for authorization. OAuth 2.0 lets an application access resources hosted by other web apps on behalf of a user without exposing credentials. WalkMe supports SP-initiated flow.
2. OpenID Connect: An identity layer built on top of OAuth 2.0. It lets WalkMe verify a user's identity based on authentication performed by an authorization server, and retrieve basic profile attributes in a standardized way.
3. SAML: The most widely used enterprise authentication protocol outside of OpenID Connect. For SAML-specific setup instructions, refer to the SAML IDP Integration article.

SAML IDP Integration

The following vendors are supported for OAuth 2.0 and OpenID Connect:

• Okta
• Google Workspace
• ADFS
• Microsoft Entra ID (formerly Azure AD)
• PingID
• Any identity provider that supports OpenID Connect

Prerequisites

Before setting up IDP Integration, an IDP application must be created to serve as the connection point between your identity provider and WalkMe. Setup instructions for all supported vendors are available directly in the configuration screen.

Additional requirements:

• Users must have admin permissions
• IDP must be configured on the required system
• Only one IDP Provider Domain is supported per connection
• Users must authenticate to the system through the IDP
• If your organization uses a Content Security Policy (CSP), add the IDP provider URL to the CSP settings in the extension configuration to prevent blocked calls

How Enforce SSO Works

Enforce SSO controls what happens when a user's IDP token is not recognized on page load.

Enabled

IDP authentication must occur before WalkMe content loads. If the token is not recognized, the user is redirected to their IDP login page. If authentication fails — due to the IDP being unavailable, invalid credentials, or the user not being assigned to the IDP app — Enforce SSO is disabled for one hour and the user identifier automatically falls back to WalkMe ID, or WalkMe will not load depending on your configuration. After one hour, if the token is still not recognized, the user is redirected to the IDP login page again.

Disabled

IDP authentication is attempted on page load, but if no active token exists, the user is not redirected. The user identifier automatically falls back to WalkMe ID, or WalkMe will not load depending on your configuration.

Get Started

To set up and manage IDP Integration, refer to the IDP Integration: Getting Started Guide.

IDP Integration: Getting Started Guide

Technical Notes

UUID and system assignment

After assigning systems to an IDP, the UUID setting for those systems is automatically set to IDP and published — no further action is required. The only way to change the UUID is to unassign the system from the IDP vendor. For changes to take effect, systems must be updated to the latest WalkMe version via a settings publish. For Enterprise accounts, select Update to the latest WalkMe version when publishing.

Changing the user identifier

Changing the user identifier affects how WalkMe recognizes users. Each user is treated as a new user tied to their new UUID value. This can reset Auto Play rules and cause completed Onboarding Tasks to appear incomplete.

Data type property supported date formats

• 2018-02-20
• 2018-02-20T14:32:00
• 12/30/2018

String and number date types are not supported in Insights filtering and editor segmentation.

Mobile Web

Mobile Web is automatically activated after IDP setup is complete. If Mobile Web is added after IDP or OneID is already active, deactivate and reactivate IDP to enable Mobile Web support.

Two-factor authentication (2FA)

Don't set 2FA on the WalkMe IDP application for users. It introduces additional authentication steps that interrupt the seamless login flow IDP Integration is designed to provide.

Safari

The Safari browser extension is not supported.

Content segmentation

After setup, use imported IDP attributes for content segmentation in Insights and in the Editor under User Attributes > IDP, with filter conditions based on the configured data field type.