--- title: Authentication domains: How your users log in and are managed source: https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/authentication-domains-saml-sso-scim-more --- To manage their users, New Relic organizations can configure one or more authentication domains, which control how users are added to a New Relic account, how they're authenticated, and more. ## Authentication domains explained [#auth-domain-definition] An **authentication domain** is a grouping of New Relic users governed by the same user management settings, like [how they're provisioned](#provisioning-users) (added and updated) and [how they're authenticated](#authentication) (logged in). When you create a New Relic organization, the default authentication settings are: - Method of provisioning users: Manual - Users are added via our [User Management UI](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-ui-and-tasks/#add-users) or our [Nerdgraph API](https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-manage-users/#create-users) - Method of managing user type: Manage with New Relic - Users' user type is managed by you via our [User Management UI](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-ui-and-tasks/#edit-user-type) or our [Nerdgraph API](https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-manage-users/#update-users) - Method of authenticating users: Username / password - Users log into New Relic directly using an [email address](https://docs.newrelic.com/docs/accounts/accounts/account-maintenance/account-email-settings/#change-email) and [password](https://docs.newrelic.com/docs/accounts/accounts/account-maintenance/change-passwords-user-preferences/) Those default settings would be under one authentication domain. If you added an additional authentication domain, you might set it up like this: - Method of provisioning users: SCIM - Users are added and managed via [SCIM provisioning](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/automated-user-provisioning-single-sign/) from a third-party identity provider such as [Okta](https://docs.newrelic.com/docs/okta-scimsso-application-configuration/), [OneLogin](https://docs.newrelic.com/docs/onelogin-scimsso-application-configuration/), [Azure/Entra](https://docs.newrelic.com/docs/azure-scimsso-application-configuration/) or via our [SCIM API](docs/accounts/accounts/automated-user-management/tutorial-manage-users-groups-scim/) - Method of authenticating users: SAML SSO - Users are logged in using SAML single sign-on (SSO) from an identity provider such as [Okta](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/authentication-domains-saml-sso-scim-more/#Okta), [OneLogin](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/authentication-domains-saml-sso-scim-more/#OneLogin), [Azure/Entra](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/authentication-domains-saml-sso-scim-more/#azure) When you add users to New Relic, they're always added to a specific authentication domain. Typically organizations have either one or two authentication domains: one with the manual methods and one for the methods associated with an identity provider. ## Requirements [#requirements] To manage authentication domains: - Your organization must be either [Pro or Enterprise edition](https://newrelic.com/pricing) to have editable authentication domains. - To view or edit authentication domains, a user must: - Have a [user type](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-type) of core user or full platform user. - Be in a group with the [**Authentication domain** administration setting](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings). - SCIM provisioning, also known as automated user management, requires Pro or Enterprise edition. [Learn more about requirements.](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/automated-user-provisioning-single-sign) - SAML SSO requires a [paid edition](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-pricing-billing/new-relic-one-pricing-billing#editions). Our SAML SSO support includes: - Active Directory Federation Services (ADFS) - Auth0 - Azure AD (Microsoft Azure Active Directory) - Google - Okta - OneLogin - Ping Identity - Salesforce - Generic support for SSO systems that use SAML 2.0 ## Create and configure an authentication domain [#ui] If you meet the [requirements](#requirements), you can add and manage authentication domains. To view and configure authentication domains: from the [user menu](https://docs.newrelic.com/docs/accounts/accounts-billing/general-account-settings/intro-account-settings), go to **Administration > Authentication domains**. If you have existing domains, they'll be in the table. Note that most organizations will have, at most, two or three domains: one with the manual, default settings and one or two for the identity provider-associated settings. To create a new domain from the authentication domain UI page, click **Create authentication domain**. To manage or delete an authentication domain, select the menu item for each authentication domain. ## Switch to different domains [#switch] If you have user records in more than one authentication domain, you can [switch between domains](https://docs.newrelic.com/docs/accounts/accounts-billing/account-setup/multiple-logins-found). ## Method of provisioning users: how your users are added and managed [#provisioning-users] > #### 💡 TIP > > - For an introduction to our SAML SSO and SCIM offerings, refer [Get started with SSO and SCIM](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/introduction-saml-scim). > - We recommend that you consider implementing [domain capture](https://docs.newrelic.com/docs/accounts/accounts-billing/account-setup/domain-capture/) that lets you automatically add users to your organization based on their email domain. This prevents users from accidentally signing up for New Relic and creating an unnecessary and unwanted New Relic organization. This feature is available for Pro and Enterprise accounts. From the [authentication domain UI](#ui), you can set one of two options for the 'Method of provisioning users': - **SCIM:** Our automated user management feature allows you to use [SCIM provisioning](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/automated-user-provisioning-single-sign/) from a third-party identity provider. - **Manual:** This means that your users are added manually to New Relic via the [User management UI](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-ui-and-tasks/#add-users) or our [Nerdgraph API](https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-manage-users/#create-users) Notes on these settings: - You can't toggle **Method of provisioning users**. This means if you want to change this for an authentication domain that's already been set up, you'll need to create a new authentication domain. - When you first enable SCIM, the bearer token is generated and only shown once. If you need to view a bearer token later, the only way to do this is to generate a new one, which will invalidate the old one and any integrations using the old token will no longer be able to successfully provision For how to set up SCIM, see [Automated user management](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/automated-user-provisioning-single-sign). ### Method of managing user type [#user-upgrade] In the **Authentication Domain UI**, if you've selected SCIM for method of provisioning users, you have two options for how your users' [user type](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-type) is managed: - **Manage user type in New Relic**: This is the default option. It allows you to manage your users' user type from New Relic. - **Manage user type with SCIM**: Enabling this means that you can no longer manage user type from New Relic. You'd only be able to change and manage it from your identity provider. More on these two options: **Manage user type in New Relic (default)** The default way to manage your users' user type is from the New Relic UI. This is the option you'd use if you aren't [managing user type via SCIM](#manage-user-type-scim). The management options governed by this include: - The ability to change user type in the [User Management UI](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-ui-and-tasks/#edit-user-type) or our [Nerdgraph API](https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-manage-users/#update-users) - The ability to [manage how user type upgrade requests are handled](#other-settings). **Manage user type with SCIM** Our [SCIM API](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/tutorial-manage-users-groups-scim#manage-user-type) lets you manage user type from your identity provider instead of in the New Relic user management UI. **When you enable this, you can no longer change or manage your users' user type from New Relic.** To enable this setting: 1. Make sure your authentication domain **Method of provisioning user** must have [SCIM enabled](#provisioning-users). 2. Follow instructions based on your indentity provider: - Okta: Follow the Okta SCIM and SSO application configuration guide [here](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/okta-scimsso-application-configuration). - Azure active directory: Refer to the New Relic forum discussion on configuring Azure AD for SCIM with user types [here](https://support.newrelic.com/s/hubtopic/aAX8W0000008d6MWAQ/relic-solution-make-full-core-basic-users-in-azure-active-directory-w-scim). - Other identity providers: Use our SCIM API user type specifications to configure your provider to send user type information to New Relic [here](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/tutorial-manage-users-groups-scim/#manage-user-type). How users upgrade requests are handled: - When you enable **Manage user type with SCIM**, the default option is that users with access limited by user type are shown a message that they need to reach out to their manager or IT department to upgrade and unlock more access. - Optionally, you can customize that message and add a link to a customized page. For example, you might add a custom message that explains to contact a specific person or department. Or you might use our [SCIM API specifications](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/tutorial-manage-users-groups-scim/#manage-user-type) to set up an implementation that programmatically handles user upgrade requests and automatically changes your users' type. ## Authentication: how your users log in [#authentication] The authentication method is the way in which New Relic users log in to New Relic. All users in an authentication domain have a single authentication method. There are two authentication options: - [Username/password](#username-authentication): Your users log in via email and password. - [SAML SSO](#saml): Your users log in via SAML single sign-on (SSO) using your identity provider. To learn how to set that up, keep reading. ### Username/password authentication [#username-authentication] This is a default authentication method. Users log in using their email address and password. For additional security, you can also enable [Multi-Factor Authentication (MFA)](#mfa). > #### ⚠️ IMPORTANT > > To receive the MFA email verification when signing into our mobile app, you must enter your email in the app and then open the login screen in your mobile browser. ### SAML SSO authentication [#saml] Before enabling SAML SSO using the instructions below, here are some things to understand and consider: - Consider reading [an introduction to New Relic SSO and SCIM](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/introduction-saml-scim). - Consider reviewing the [SAML SSO requirements](#requirements). - Consider watching a [video on how to set up SAML SSO](https://www.youtube.com/watch?v=uFjqCQcSo8g). - Note that your SSO-enabled users won't receive email verification notifications from New Relic because the login and password information is handled by your identity provider. - Consult your identity provider service's docs because they may have New Relic-specific instructions. 1. If you're setting up SCIM provisioning: - If you use Azure, Okta, or OneLogin, follow these procedures first: [Azure](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/azure-ad-scimsso-application-configuration/) \| [OneLogin](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/onelogin-scimsso-application-configuration/) \| [Okta](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/okta-scimsso-application-configuration/). - If you use a different identity provider, follow the SAML procedures below and use our [SCIM API](https://docs.newrelic.com/docs/accounts/accounts/automated-user-management/scim-support-automated-user-management/) to enable SCIM. 2. If you **only** want to enable SAML SSO and not SCIM, and if you use Azure, Okta, or OneLogin, follow these instructions for configuring the relevant app: **Azure app** Azure AD provides an application gallery, which includes various integrations for Azure AD, including the ones that New Relic offers. Add the New Relic SCIM/SSO application to your list of applications. 1. Go to the Azure Active Directory admin center, and sign in if necessary. [aad.portal.azure.com/](https://aad.portal.azure.com/) 2. Click on **All services** in the left hand menu. 3. In the main pane, click on **Enterprise applications**. 4. Click on **+New application**. 5. Find our SCIM/SSO application by entering **New Relic** in the name search box, and click on the application **New Relic by organization** (not **New Relic by account**). 6. Click on **Add**. **Okta app** Add the New Relic SCIM/SSO application to your Okta applications. 1. Go to [okta.com/](https://www.okta.com/) and sign in with an account that has administrator permissions. 2. From the Okta home page, click on **Admin**. 3. From the Okta admin **Dashboard**, choose the **Applications** page. 4. Click **Browse app catalog**, then search and select "New Relic by organization". 5. From the New Relic by Organization page, click on **Add**. 6. From the Add New Relic by Organization page, check the two **Application visibility "Do not display..."** checkboxes and click on **Done**. We will make the application visible later after configuration is complete and provisioning has begun. 7. Open the newly created application in Okta and go to the **Assignments** tab. This is where you can add users and groups for authentication. 8. From there, go to the **Sign On** tab. Under **Advanced Sign-on Settings**, you'll see **Authentication Domain ID**, which you'll need to edit this field in Step 9 of the general instructions below. To the right, click **View SAML setup instructions**. Under **Step 7** of these instructions, you can find the URLs required for Steps 6 and 7 in the general instructions below. **OneLogin app** Add the New Relic SCIM/SSO application to your OneLogin applications. 1. Go to the OneLogin web site and sign in with an account that has administrator permissions. 2. From the OneLogin home page, click on **Administration**. 3. From the OneLogin Administration page, choose the **Applications** menu. 4. From the OneLogin Applications page, click on **Add app**. 5. In the search field on the OneLogin Find Applications page, enter "New Relic by organization" (not "New Relic by account") and then click on the application when it shows in the search results. 6. From the **Add New Relic by organization** page, click on **Save**. - If you're implementing SAML using a different identity provider not mentioned above, you'll need to attempt to integrate using the SAML instructions below. Note that your identity provider must use the SAML 2.0 protocol, and must require signed SAML assertions. 3. Next, you'll go to our authentication domain UI. From the [user menu](https://docs.newrelic.com/docs/accounts/accounts-billing/general-account-settings/intro-account-settings), click **Administration**, and then click **Authentication domains**. If you don't already have one, [create a new domain](#ui) to be used for your SAML-authenticating users. 4. Under **Authentication**, click **Configure**. Under **Method of authenticating users**, select **SAML SSO**. 5. If you're using the Okta, OneLogin, or Azure AD app, you can skip this step. Under **Provided by New Relic**, we have some New Relic-specific information. You'll need to place these in the relevant fields in your identity provider service. If you're not sure where they go, consult your identity provider docs. 6. Under **Provided by you**, input the **Source of SAML metadata**. This URL is supplied by your identity provider and may be called something else. It should conform to SAML V2.0 metadata standards. If your identity provider **doesn't** support dynamic configuration, you can do this by using **Upload a certificate**. This should be a PEM encoded x509 certificate. 7. Under **Provided by you**, set the **SSO target URL** supplied by your identity provider. You can find this by going to the **Source of SAML metadata** and finding the POST binding URL. It looks like: `https://newrelic.oktapreview.com/app/newreliclr/1234567890abcdefghij/sso/saml`. 8. If your identity provider has a redirect URL for logout, enter it in the **Logout redirect URL**; otherwise, leave it blank. 9. If you're using an identity provider app, you'll need to input the authentication domain ID in the app. That ID is found at the top of New Relic's authentication domain UI page. 10. Optional: In New Relic's authentication domain UI, you can adjust [other settings](#other-settings), like browser session length and user upgrade method. You can adjust these settings at any time. 11. If you're enabling SAML only, you'll need to create groups. (If you enabled SCIM, you've already completed this step.) Groups are what give your users access to New Relic accounts. Without being assigned to groups, your users are provisioned in New Relic but have no access to accounts or roles. To learn how to do this: - [Learn how user group access works](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#understand-concepts) - Read the [User management tutorial](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/tutorial-add-new-user-groups-roles-new-relic-one-user-model/). 12. Okta only: Return to Okta's New Relic app and, from the **Add New Relic by organization** page, uncheck the two **Application visibility "Do not display..."** checkboxes and click on **Done**. To verify it's been set up correctly, see if your users can log in to New Relic via your identity provider and ensure they have access to their accounts. ### Set up MFA [#mfa] Multi-factor authentication (MFA) adds a layer of security to your data by requiring users in an authentication domain to verify their identity. When enabled, users receive a verification email each time they log in. During their first MFA-required login, users also receive ten backup codes. These codes are used if they can't access their email. Advise your users to store these codes in a secure location. To complete MFA verification for the New Relic mobile app, enter your email in the app and then follow the prompt to open the login screen in your mobile browser. **To enable MFA:** 1. Go to [one.newrelic.com > Administration > Authentication Domains](https://onenr.io/08jqqPYdvjl) 2. Select the required domain. 3. Enable the MFA toggle. Once enabled, users in that authentication domain are prompted to verify their email at their next login and all subsequent logins. > #### ⚠️ IMPORTANT > > To receive the MFA email verification when signing into our mobile app, you must enter your email in the app and then open the login screen in your mobile browser. ## Other user-related settings [#other-settings] To manage session-related settings, and whether users can self-upgrade or not: 1. From the [**User management** UI](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-ui-and-tasks/#where), select an authentication domain from the switcher. 2. Click the gear icon . 3. Edit the settings, which are described in more detail below. ### Session-related settings [#session-mgmt] Session-related settings include: - Length of time users can remain logged in - Amount of idle time before a user's session expires ([learn about session limits](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/factors-affecting-access-features-data#session-limits)) ### User upgrade settings [#user-upgrade-settings] Settings related to how users upgrade to higher user type include: - **Automatic approval**: This allows users to be able to immediately upgrade to a higher user type on their own, without approval. This allows these users to be able to more quickly respond to issues. - **Require review**: With this option, admins (users with the [**Authentication domain** administration setting](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings)) receive an email when a user requests an upgrade, and can approve or deny those requests in the [**User management** UI](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-ui-and-tasks#where). - A user is limited to 6 upgrade requests over a 24-hour sliding window. For example, if you make your 6 upgrade requests between 8am to 10am, then you're required to wait until 8am the next day before making another upgrade request.