# Setting up SAML SSO for Unified CM

Systems: Cisco Unified CM

For Unified CM administrators configuring SAML 2.0 single sign-on who have administrative access to Unified CM and access to their identity provider.

Canonical: https://warmtransfer.net/guides/cucm-saml-sso-setup

Last verified: 2026-09-25

Cisco Collaboration SAML SSO supports SAML 2.0 service-provider-initiated SSO only[^51]. Cisco lists AD FS 2.0 to 5.0, Microsoft Entra ID, Okta, OpenAM, PingFederate, and F5 BIG-IP as IdPs tested with Cisco Collaboration SAML SSO[^54].

## Before you start

- Ensure that NTP synchronisation is configured, with a maximum allowed time difference between the IdP and the Unified Communications applications of 3 seconds[^35].
- Ensure the browser can resolve both the service provider hostname and the IdP, including the service provider ACS URL the IdP redirects to[^11].
- Confirm that LDAP directory synchronisation is configured, as synchronising users between Unified Communications applications and the LDAP directory is mandatory for SAML SSO[^28].
- Identify a test user who is an LDAP-synchronised user with Standard CCM Super User permissions[^53]. Authorisation for SAML SSO administrator access is based on role-based access control configured locally on the Cisco collaboration application, not on the IdP[^6].
- Confirm the LDAP attribute used as the Unified CM user ID, because the IdP must send a claim named `uid` whose value maps to that attribute[^56].

## What changes by situation

- Which identity provider will authenticate your users? Microsoft Entra ID; Microsoft AD FS (on-premises); Okta.
- Will you configure one SAML agreement for the whole cluster, or one per node? Cluster wide, one metadata file and one IdP agreement for the cluster; Per Node, one metadata file and IdP agreement for each node.
- Which certificate will sign the Unified CM SP metadata? The Cisco Tomcat certificate; The system-generated self-signed certificate.
- How is IM and Presence deployed alongside this cluster? Standard Deployment, with IM and Presence nodes inside the Unified CM cluster; Centralized Deployment, with a standalone IM and Presence cluster; No IM and Presence Service.
- Is FIPS mode or Enhanced Security Mode enabled on the cluster? Yes, FIPS or ESM is on; No.

## Step 1: Verify the identity provider and SSO mode support

**Microsoft Entra ID + Cluster wide, one metadata file and one IdP agreement for the cluster**

### Do
Proceed with Microsoft Entra ID using the cluster-wide mode[^13].

### Verify
Suggested check: verify that a single SSO agreement is planned for the cluster.

**Microsoft Entra ID + Per Node, one metadata file and IdP agreement for each node**

### Do
Change your configuration plan to cluster-wide mode, because with Microsoft Entra ID, Unified CM supports cluster wide agreements only and per node agreements are not supported[^13].

### Verify
Suggested check: verify that the configuration plan is updated to use cluster-wide mode.

**Microsoft AD FS (on-premises) + Cluster wide, one metadata file and one IdP agreement for the cluster**

### Do
Proceed with AD FS using a single cluster-wide agreement[^31].

### Verify
Suggested check: verify that a single relying party trust is planned in the identity provider.

**Microsoft AD FS (on-premises) + Per Node, one metadata file and IdP agreement for each node**

### Do
Proceed with AD FS using per-node agreements, where each node will require its own agreement at the IdP[^32].

### Verify
Suggested check: verify that one relying party trust per cluster node is planned in the identity provider.

**Okta + Cluster wide, one metadata file and one IdP agreement for the cluster**

### Do
Proceed with Okta using cluster-wide mode, as SAML SSO with Okta can be enabled with the cluster-wide option only[^38].

### Verify
Suggested check: verify that a single SAML application is planned for the cluster.

**Okta + Per Node, one metadata file and IdP agreement for each node**

### Do
Change your configuration plan to cluster-wide mode, because the per node option is not available for Okta[^38].

### Verify
Suggested check: verify that the configuration plan is updated to use cluster-wide mode.

## Step 2: Prepare the service-provider certificate

**The Cisco Tomcat certificate**

### Do
Ensure the Cisco Tomcat certificate Common Name or Subject Alternative Name matches the FQDN requested by the browser[^10]. Cisco strongly recommends CA-signed server certificates for SAML SSO and multiserver certificates where supported[^7]. In a cluster-wide agreement, pushing metadata created on one node to other nodes relies on a multi-server Tomcat certificate with a shared key pair when the Tomcat certificate is used[^49].

### Verify
For Jabber SSO, deploy certificates on all servers so a web browser can validate them without invalid-certificate warnings[^26].

### Rollback
Regenerating the Tomcat certificate regenerates SP metadata, which must then be re-uploaded to the IdP[^30].

**The system-generated self-signed certificate**

### Do
From Release 12.0, use the system-generated self-signed (ITLRecovery) certificate option for cluster-wide SSO[^9]. When exporting metadata, select the system-generated self-signed certificate option[^8].

### Verify
For Jabber SSO, deploy certificates on all servers so a web browser can validate them without invalid-certificate warnings[^26].

### Rollback
Switching between self-signed and Tomcat certificates regenerates SP metadata, which must then be re-uploaded to the IdP[^30].

## Step 3: Export the Unified CM SP metadata

**Cluster wide, one metadata file and one IdP agreement for the cluster**

### Do
In Cisco Unified CM Administration, navigate to System > SAML Single Sign On[^29]. Select Cluster wide, choose the certificate option, click Export All Metadata, and save the file to a secure location[^19].

### Verify
Confirm that Cluster wide SSO mode produced a single metadata file representing the entire cluster[^31].

**Per Node, one metadata file and IdP agreement for each node**

### Do
In Cisco Unified CM Administration, navigate to System > SAML Single Sign On[^29]. Select Per Node, choose the certificate option, click Export All Metadata, and save the files to a secure location[^19].

### Verify
Confirm that Per Node SSO mode produced a separate metadata XML file for each cluster node[^32].

## Step 4: Account for IM and Presence metadata

**Standard Deployment, with IM and Presence nodes inside the Unified CM cluster**

### Do
Maintain the exported Unified CM metadata without generating an additional file, as an IM and Presence Standard Deployment includes IM and Presence metadata in the Unified CM metadata export[^24].

### Verify
Suggested check: verify that the exported metadata XML includes the IM and Presence node entries.

**Centralized Deployment, with a standalone IM and Presence cluster**

### Do
In an IM and Presence Centralized Deployment, export metadata and repeat the SSO configuration steps separately on the standalone IM and Presence publisher node[^23].

### Verify
Suggested check: verify that separate metadata has been exported from the standalone IM and Presence publisher node.

**No IM and Presence Service**

### Do
Cluster wide SSO mode produces a single metadata file that represents the entire cluster[^31].

### Verify
Suggested check: verify that only Unified CM nodes are present in the exported SP metadata.

## Step 5: Configure the IdP and download its metadata

**Microsoft Entra ID**

### Do
Add the Cisco Unified Communications Manager gallery application in Microsoft Entra ID, select SAML, and upload the Unified CM SP metadata file to populate the Identifier (Entity ID) and Reply URL[^16]. Set the enterprise application property "Enabled for users to sign in?" to Yes[^15]. Map the `uid` claim to the source attribute `user.onpremisessamaccountname`[^18]. If the Unified CM user ID is not the default sAMAccountName, change the `uid` claim source to the matching Entra ID attribute[^17]. Download the Federation Metadata XML from the SAML Signing Certificate section[^14].

### Verify
Ensure the IdP sends the claim named `uid` mapped to the Unified CM user ID[^56], and that the IdP NameID format is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`[^34].

**Microsoft AD FS (on-premises) + Cluster wide, one metadata file and one IdP agreement for the cluster**

### Do
In AD FS, use the Add Relying Party Trust wizard to import the Unified CM SP metadata file, border-served at `https://<CUCM_FQDN>:8443/ssosp/ws/config/metadata/sp`[^4]. Create a claim rule using the Send LDAP Attributes as Claims template, mapping the LDAP directory-sync attribute (for example SAM-Account-Name) to an outgoing claim type typed manually as lowercase `uid`[^5]. Add a second, custom claim rule that issues a transient NameID with `namequalifier` set to the AD FS identity and `spnamequalifier` set to the Unified CM entity ID[^2]. Download the AD FS IdP metadata from `https://<ADFS_FQDN>/FederationMetadata/2007-06/FederationMetadata.xml`[^1].

### Verify
Confirm that multiple certificates are not present in the signing and encryption portion of the assertion, as multiple certificates are not supported[^50]. Ensure the IdP NameID format is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`[^34].

**Microsoft AD FS (on-premises) + Per Node, one metadata file and IdP agreement for each node**

### Do
In AD FS, use the Add Relying Party Trust wizard to import each node's Unified CM SP metadata file, also served at `https://<CUCM_FQDN>:8443/ssosp/ws/config/metadata/sp`[^4]. For each relying party trust, add a rule using the Send LDAP Attributes as Claims template mapping the LDAP directory-sync attribute to outgoing lowercase `uid`[^5]. For each trust, add a second custom rule that issues a transient NameID with `namequalifier` set to the AD FS identity and `spnamequalifier` set to the node's Unified CM entity ID[^2]. Download the AD FS IdP metadata from `https://<ADFS_FQDN>/FederationMetadata/2007-06/FederationMetadata.xml`[^1].

### Verify
Confirm that multiple certificates are not present in the signing and encryption portion of the assertion, as multiple certificates are not supported[^50]. Ensure the IdP NameID format is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`[^34].

**Okta + Cluster wide, one metadata file and one IdP agreement for the cluster**

### Do
In the Okta SAML 2.0 web app, configure the Single Sign On URL to the SP metadata AssertionConsumerService at index 0 and configure the Audience URI to the SP metadata entityID[^37]. For multi-node clusters, enable "Allow this app to request other SSO URLs" and add each node's HTTP-POST ACS URL as a requestable SSO URL[^40]. Ensure the `uid` claim is mapped to the attribute matching the Unified CM user ID[^56]. Download the IdP metadata from the Okta Sign On tab and edit its NameIDFormat lines to the transient format before importing into Unified CM[^39].

### Verify
Ensure the IdP NameID format is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`[^34].

**Okta + Per Node, one metadata file and IdP agreement for each node**

### Do
Do not configure per-node agreements in Okta, as the per node option is not available for Okta[^38]. Enable SAML SSO with Okta with the cluster-wide option only[^38].

### Verify
Suggested check: verify that per-node configuration on the identity provider is halted.

## Step 6: Restart Cisco Tomcat

### Do
Restart the Cisco Tomcat service before enabling SAML SSO by running `utils service restart Cisco Tomcat` on all Unified CM and IM and Presence cluster nodes where SSO runs[^47][^55].

### Verify
Suggested check: verify that the service is active on each node and that the administrative interface is accessible.

## Step 7: Run the Enable SAML SSO wizard and test

**Cluster wide, one metadata file and one IdP agreement for the cluster**

### Do
In Cisco Unified CM Administration, navigate to System > SAML Single Sign On, click Enable SAML SSO, click Continue, and run the Test for Multi-server tomcat certificates step[^12][^33]. Click Next, browse to the IdP metadata file, click Import IdP Metadata, and click Next[^12]. Select the test user, click Run SSO Test, sign in at the IdP prompt, and then click Finish[^12].

### Verify
Confirm that the wizard reports "SSO Test Succeeded!"[^52]. Run `utils sso status` on the CLI to confirm current SSO configuration, metadata import, and SSO test status[^60].

### Rollback
Run `utils sso disable` on the CLI to disable SAML SSO and return sign-in to local authentication[^59]. After disabling, restart Cisco Tomcat with `utils service restart Cisco Tomcat` on all Unified CM and IM and Presence cluster nodes where SSO runs[^55].

**Per Node, one metadata file and IdP agreement for each node**

### Do
In Cisco Unified CM Administration on each node, navigate to System > SAML Single Sign On, click Enable SAML SSO, click Continue, click Next, browse to the IdP metadata file, click Import IdP Metadata, and click Next[^12]. Select the test user, click Run SSO Test, sign in, and click Finish[^12]. Repeat the enable process on each Unified CM node[^41].

### Verify
Confirm that the wizard on each node reports "SSO Test Succeeded!"[^52]. Run `utils sso status` on each node's CLI to confirm metadata import and test status[^60].

### Rollback
Run `utils sso disable` on the CLI to return sign-in to local authentication[^59]. After disabling, restart Cisco Tomcat with `utils service restart Cisco Tomcat` on all Unified CM and IM and Presence cluster nodes where SSO runs[^55].

## Step 8: Apply security mode signing requirements and restart Tomcat

**Yes, FIPS or ESM is on**

### Do
On the admin CLI of all Unified CM nodes, set the SSO signing algorithm to SHA256 using `utils sso set signing-algorithm sha256`[^20]. Restart Cisco Tomcat with `utils service restart Cisco Tomcat` on all Unified CM and IM and Presence cluster nodes where SSO runs[^55].

### Verify
Suggested check: verify that an administrative user can sign in via single sign-on after the service restarts.

### Rollback
Run `utils sso disable` from the CLI to return to local authentication[^59].

**No**

### Do
Restart Cisco Tomcat with `utils service restart Cisco Tomcat` on all Unified CM and IM and Presence cluster nodes where SSO runs[^55].

### Verify
Suggested check: verify that an administrative user can sign in via single sign-on after the service restarts.

### Rollback
Run `utils sso disable` from the CLI to return to local authentication[^59].

## Step 9: Validate the recovery URL and platform administrators

### Do
Access the SAML SSO recovery URL at `https://<hostname>:8443/ssosp/local/login`, which bypasses SSO for troubleshooting and administrative tasks such as updating metadata[^45]. Sign in with an application user that has administrative privileges, as only application users with administrative privileges can use the recovery URL[^43]. Note that the recovery URL is enabled or disabled from the CLI with `utils sso recovery-url enable` and `utils sso recovery-url disable`[^44]. For Cisco Unified OS Administration and Disaster Recovery System, provision platform administrators on each node individually, because each platform administrator is specific to a node and is not replicated across the cluster[^42].

### Verify
Confirm that administrative access is granted through `https://<hostname>:8443/ssosp/local/login` without redirecting to the IdP[^45]. Note that the recovery URL does not work for end users, LDAP or local, signing in to the Self Care portal[^46].

### Rollback
Run `utils sso recovery-url disable` on the CLI to disable the recovery URL if policy forbids an SSO bypass[^44].

## Step 10: Configure client and token settings

### Do
Ensure Cisco Jabber can reach service discovery influenced by the ServicesDomain, VoiceServicesDomain, and ServiceDiscoveryExcludedServices parameters, which Jabber uses to enable SAML SSO in the client[^27]. Leave SSO Login Behavior for Cisco Jabber on iOS set to Use Embedded Browser, as Cisco does not recommend Use Native Browser except in a controlled MDM deployment[^25]. If Jabber OAuth with refresh tokens is used, note that it requires Unified CM 11.5(SU3) or 12.0 and later, and configure the access and refresh token expiry timers in the Unified CM enterprise parameters[^36].

### Verify
Suggested check: verify that a client performs service discovery and redirects to the IdP for authentication.

## Step 11: Execute maintenance updates and troubleshooting

### Do
When IdP metadata changes, sign in through the recovery URL, choose System > SAML Single Sign On, click Update IdP Metadata File, import the new file, run the SSO test with a Standard CCM Super User, and click Finish[^57]. Note that updating IdP metadata in cluster-wide mode restarts the Cisco Tomcat, Cisco SSOSP Tomcat, and Cisco UDS Tomcat services on all cluster nodes[^58]. After a server domain or hostname change, export new metadata via the recovery URL, upload it to the IdP, and run the SSO test, as SAML SSO does not work until these steps are completed[^21]. SP metadata must also be re-uploaded to the IdP after switching between self-signed and Tomcat certificates, regenerating the Tomcat certificate, or changing cluster configuration[^30]. If sign-in fails, raise SSO logging to debug on each node by running `set samltrace level debug`[^48].

### Verify
After updating IdP metadata, confirm that the SSO test succeeds[^57]. Use `utils sso status` to inspect configuration status[^60].

### Rollback
Run `utils sso disable` from the CLI to disable SAML SSO and revert to local authentication[^59].

## Applicability

Applies to: Cisco Unified Communications Manager, Microsoft Entra ID, Cisco Unified Communications Manager IM, and Cisco Jabber. Deployments: on-premises and multi-tenant. Sources checked 2026-09-25. Jabber OAuth with refresh tokens requires Unified CM 11.5(SU3) or 12.0 and later[^36]. From Release 12.0, cluster-wide SSO requires either a multi-server Tomcat certificate or the system-generated self-signed (ITLRecovery) certificate option[^9].

## What remains uncertain

Whether the IdP signing algorithm must match Unified CM when FIPS mode or Enhanced Security Mode is disabled is not covered by the sources below. Whether `utils sso disable` acts cluster-wide or requires per-node execution on Release 15 is not covered by the sources below. The specific actions taken by the enable wizard when the Test for Multi-server tomcat certificates fails are not covered by the sources below.

## Sources

[^1]: AD FS IdP metadata is downloaded from https://<ADFS_FQDN>/FederationMetadata/2007-06/FederationMetadata.xml. Source: [Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/216948-configure-saml-sso-on-cisco-unified-comm.html), Configure > IdP metadata export. Checked 2026-09-25.
[^2]: AD FS needs a second, custom claim rule that issues a transient NameID with namequalifier set to the AD FS identity and spnamequalifier set to the Unified CM entity ID. Source: [Configure Single SAML IdP Connection/Agreement per Cluster with AD FS Version 2.0](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200532-Configure-Single-SAML-IDP-Connection-Agr.html), Configure > AD FS claim rules > custom NameID rule. Checked 2026-09-25.
[^3]: Of the three IdPs covered here, only AD FS has no Cisco statement restricting Unified CM to cluster-wide agreements, so AD FS is the IdP on which per node mode remains an option (inferred). Source: [Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/216948-configure-saml-sso-on-cisco-unified-comm.html), Per-node versus cluster-wide discussion (technote recommends Cluster Wide). Checked 2026-09-25.
[^4]: Cisco's AD FS 3.0 example imports Unified CM SP metadata, also served at https://<CUCM_FQDN>:8443/ssosp/ws/config/metadata/sp, with the Add Relying Party Trust wizard. Source: [Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/216948-configure-saml-sso-on-cisco-unified-comm.html), Configure > Add Relying Party Trust. Checked 2026-09-25.
[^5]: In AD FS the first claim rule uses the Send LDAP Attributes as Claims template, mapping the LDAP attribute used for Unified CM directory sync (for example SAM-Account-Name) to an outgoing claim type typed manually as lowercase uid. Source: [Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/216948-configure-saml-sso-on-cisco-unified-comm.html), Configure > Claim rules > Rule 1. Checked 2026-09-25.
[^6]: Authorisation for SAML SSO administrator access is based on role-based access control configured locally on the Cisco collaboration application, not on the IdP. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML-Based SSO Solution](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_b_saml-sso-deployment-guide-12_5_chapter_01.html), SAML-Based SSO Solution > authorisation note. Checked 2026-09-25.
[^7]: Cisco strongly recommends CA-signed server certificates for SAML SSO and multiserver certificates where the product supports them. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Prerequisites > Certificate Management. Checked 2026-09-25.
[^8]: When exporting metadata the administrator chooses either a system-generated self-signed certificate or the Cisco Tomcat certificate. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Initiate SSO Configuration on Collaboration Applications > Certificate. Checked 2026-09-25.
[^9]: Cluster-wide SSO requires either a multi-server Tomcat certificate or, from Release 12.0, the system-generated self-signed (ITLRecovery) certificate option. Source: [Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/217268-configure-and-troubleshoot-sso-on-cisco.html), Background information > cluster-wide SSO. Checked 2026-09-25.
[^10]: The certificate Common Name or Subject Alternative Name must match the FQDN the browser requests. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Prerequisites > Certificate Management. Checked 2026-09-25.
[^11]: The browser must be able to resolve both the service provider hostname and the IdP, including the service provider ACS URL the IdP redirects to. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Prerequisites > DNS Setup. Checked 2026-09-25.
[^12]: The enable procedure is: System > SAML Single Sign On, Enable SAML SSO, Continue, Next, browse to the IdP metadata file, Import IdP Metadata, Next, select a test user, Run SSO Test, sign in, then Finish. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Enable SAML SSO for Cisco Collaboration Applications > procedure. Checked 2026-09-25.
[^13]: With Microsoft Entra ID, Unified CM, IM and Presence, Unity Connection and Expressway support cluster wide agreements only; per node agreements are not supported. Source: [SAML SSO Microsoft Entra ID Identity Provider](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/Azure/cucm_b_saml-sso-microsoft-azure-idp.html), Overview / supported agreements note. Checked 2026-09-25.
[^14]: The Entra ID IdP metadata for Unified CM is the Federation Metadata XML downloaded from the SAML Signing Certificate section. Source: [Configure Cisco Unified Communications Manager for Single sign-on with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-unified-communications-manager-tutorial), Configure Microsoft Entra SSO > step 8. Checked 2026-09-25.
[^15]: Cisco's Entra ID guide requires the enterprise application property 'Enabled for users to sign in?' to be Yes. Source: [SAML SSO Microsoft Entra ID Identity Provider](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/Azure/cucm_b_saml-sso-microsoft-azure-idp.html), Configure SAML SSO on Microsoft Entra ID > Properties. Checked 2026-09-25.
[^16]: In Entra ID the Cisco Unified Communications Manager gallery application is added, SAML is chosen, and uploading the Unified CM SP metadata file populates the Identifier (Entity ID) and Reply URL. Source: [SAML SSO Microsoft Entra ID Identity Provider](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/Azure/cucm_b_saml-sso-microsoft-azure-idp.html), Configure SAML SSO on Microsoft Entra ID > enterprise application and Basic SAML Configuration. Checked 2026-09-25.
[^17]: Cisco's Entra ID guide says that if the Unified CM user ID is not the default sAMAccountName, the uid claim source must be changed to the matching Entra ID attribute. Source: [SAML SSO Microsoft Entra ID Identity Provider](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/Azure/cucm_b_saml-sso-microsoft-azure-idp.html), Configure SAML SSO on Microsoft Entra ID > Attributes & Claims. Checked 2026-09-25.
[^18]: Microsoft's tutorial maps the uid claim to the source attribute user.onpremisessamaccountname. Source: [Configure Cisco Unified Communications Manager for Single sign-on with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-unified-communications-manager-tutorial), Configure Microsoft Entra SSO > step 7 attribute table. Checked 2026-09-25.
[^19]: After selecting SSO mode and certificate, the administrator clicks Export All Metadata and saves the file to a secure location. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Initiate SSO Configuration on Collaboration Applications > procedure steps 1-4. Checked 2026-09-25.
[^20]: If FIPS or Enhanced Security Mode is enabled, set the SSO signing algorithm to SHA256 with 'utils sso set signing-algorithm sha256' on the admin CLI of all Unified CM nodes. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Enable SAML SSO for Cisco Collaboration Applications > FIPS/ESM note. Checked 2026-09-25.
[^21]: After a server domain or hostname change SAML SSO does not work until new metadata is exported via the recovery URL, uploaded to the IdP and the SSO test is run. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Additional Configuration Tasks > domain or hostname change. Checked 2026-09-25.
[^22]: Because Unified CM SSO is SP-initiated only, IdP-side objects created before Enable SAML SSO completes are not used by Unified CM, so removing them before that point does not affect Unified CM sign-in (inferred). Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_requirements-for-identity-providers.html), SAML SSO Requirements for Identity Providers (SP-initiated only). Checked 2026-09-25.
[^23]: With an IM and Presence Centralized Deployment, metadata is exported and the SSO configuration steps are repeated separately on the standalone IM and Presence publisher node. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), SSO Configuration for IM and Presence Service > Centralized Deployment. Checked 2026-09-25.
[^24]: With an IM and Presence Standard Deployment, IM and Presence metadata is included in the Unified CM metadata export. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Initiate SSO Configuration on Collaboration Applications > note; SSO Configuration for IM and Presence Service. Checked 2026-09-25.
[^25]: The SSO Login Behavior for iOS enterprise parameter defaults to Use Embedded Browser, and Cisco does not recommend Use Native Browser except in a controlled MDM deployment. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Configure SSO Login Behavior for Cisco Jabber on iOS (System > Enterprise Parameters). Checked 2026-09-25.
[^26]: For Jabber SSO, certificates must be deployed on all servers so a web browser can validate them, otherwise users see invalid-certificate warnings. Source: [On-Premises Deployment for Cisco Jabber 12.6 - Users](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/12_6/cjab_b_on-prem-deployment-cisco-jabber_12-6/cjab_b_on-prem-deployment-cisco-jabber_12-6_chapter_01001.html), Enable SAML SSO in the Client > step 1. Checked 2026-09-25.
[^27]: Cisco Jabber uses standard service discovery to enable SAML SSO in the client, influenced by the ServicesDomain, VoiceServicesDomain and ServiceDiscoveryExcludedServices parameters. Source: [On-Premises Deployment for Cisco Jabber 12.6 - Users](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/12_6/cjab_b_on-prem-deployment-cisco-jabber_12-6/cjab_b_on-prem-deployment-cisco-jabber_12-6_chapter_01001.html), Enable SAML SSO in the Client > step 2. Checked 2026-09-25.
[^28]: LDAP directory synchronisation is mandatory for SAML SSO: users must be synchronised between the Unified Communications applications and the LDAP directory. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Prerequisites > Directory Setup. Checked 2026-09-25.
[^29]: SAML SSO is configured in Cisco Unified CM Administration under System > SAML Single Sign On. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), SAML SSO Configuration Task Flow > Initiate SSO Configuration on Collaboration Applications. Checked 2026-09-25.
[^30]: Switching between self-signed and Tomcat certificates, regenerating the Tomcat certificate, or changing cluster configuration regenerates SP metadata, which must be re-uploaded to the IdP. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Feature Interactions and Restrictions. Checked 2026-09-25.
[^31]: Cluster wide SSO mode produces a single metadata file that represents the entire cluster. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Initiate SSO Configuration on Collaboration Applications > SSO Mode. Checked 2026-09-25.
[^32]: Per Node SSO mode produces a separate metadata XML file for each cluster node, each needing its own agreement at the IdP. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Initiate SSO Configuration on Collaboration Applications > SSO Mode. Checked 2026-09-25.
[^33]: For cluster wide agreements only, the enable wizard includes a Test for Multi-server tomcat certificates step. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Enable SAML SSO for Cisco Collaboration Applications > procedure step 4. Checked 2026-09-25.
[^34]: The IdP NameID format must be urn:oasis:names:tc:SAML:2.0:nameid-format:transient. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_requirements-for-identity-providers.html), SAML SSO Requirements for Identity Providers. Checked 2026-09-25.
[^35]: SAML SSO for Unified CM requires NTP synchronisation, and the maximum allowed time difference between the IdP and the Unified Communications applications is 3 seconds. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Prerequisites > NTP Setup. Checked 2026-09-25.
[^36]: Jabber OAuth with refresh tokens requires Unified CM 11.5(SU3) or 12.0 and later, and the access and refresh token expiry timers are Unified CM enterprise parameters. Source: [Planning Guide for Cisco Jabber 14.0 - User Management](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/14_0/cjab_b_planning-guide-cisco-jabber-14_0/cjab_b_planning-guide-cisco-jabber-129_chapter_011.html), User Management > OAuth. Checked 2026-09-25.
[^37]: In the Okta SAML 2.0 web app, the Single Sign On URL is the SP metadata AssertionConsumerService at index 0 and the Audience URI is the SP metadata entityID. Source: [SAML SSO Okta Identity Provider](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/okta/12_0_1/cucm_b_saml-sso-okta-identity-provider.html), Configure Okta > Create new app > SAML settings. Checked 2026-09-25.
[^38]: SAML SSO with Okta can be enabled with the cluster-wide option only; the per node option is not available for Okta. Source: [SAML SSO Okta Identity Provider](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/okta/12_0_1/cucm_b_saml-sso-okta-identity-provider.html), Okta guide > restriction note. Checked 2026-09-25.
[^39]: Cisco's Okta guide downloads the IdP metadata from the Okta Sign On tab and edits its NameIDFormat lines to the transient format before importing into Unified CM. Source: [SAML SSO Okta Identity Provider](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/okta/12_0_1/cucm_b_saml-sso-okta-identity-provider.html), Configure Okta > download IdP metadata. Checked 2026-09-25.
[^40]: For multi-node clusters Cisco's Okta guide enables 'Allow this app to request other SSO URLs' and adds each node's HTTP-POST ACS URL as a requestable SSO URL. Source: [SAML SSO Okta Identity Provider](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/okta/12_0_1/cucm_b_saml-sso-okta-identity-provider.html), Configure Okta > Advanced settings > Requestable SSO URLs. Checked 2026-09-25.
[^41]: With per node agreements, the enable process is repeated on each Unified CM node. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Enable SAML SSO for Cisco Collaboration Applications > per node note. Checked 2026-09-25.
[^42]: For Cisco Unified OS Administration and Disaster Recovery System, each platform administrator is specific to a node and is not replicated across the cluster. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML-Based SSO Solution](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_b_saml-sso-deployment-guide-12_5_chapter_01.html), SAML SSO for platform applications note. Checked 2026-09-25.
[^43]: Only application users with administrative privileges can use the recovery URL. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Recovery URL. Checked 2026-09-25.
[^44]: The recovery URL is enabled or disabled from the CLI with 'utils sso recovery-url enable' and 'utils sso recovery-url disable'. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Recovery URL. Checked 2026-09-25.
[^45]: The SAML SSO recovery URL is https://<hostname>:8443/ssosp/local/login and bypasses SSO for troubleshooting and administrative tasks such as updating metadata. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Recovery URL. Checked 2026-09-25.
[^46]: The recovery URL does not work for end users, LDAP or local, signing in to the Self Care portal. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Recovery URL. Checked 2026-09-25.
[^47]: Cisco instructs restarting the Cisco Tomcat service before enabling SAML SSO. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Enable SAML SSO for Cisco Collaboration Applications > Before you begin. Checked 2026-09-25.
[^48]: 'set samltrace level debug' raises SSO logging to debug and must be run on each node. Source: [Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/217268-configure-and-troubleshoot-sso-on-cisco.html), Troubleshoot > set log level. Checked 2026-09-25.
[^49]: In a cluster-wide (single) agreement one node creates the SP metadata and pushes it to the other nodes, which relies on a multi-server Tomcat certificate with a shared key pair when the Tomcat certificate is used. Source: [Configure Single SAML IdP Connection/Agreement per Cluster with AD FS Version 2.0](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200532-Configure-Single-SAML-IDP-Connection-Agr.html), Background Information. Checked 2026-09-25.
[^50]: Multiple certificates in the signing and encryption portion of the SAML assertion are not supported. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_requirements-for-identity-providers.html), SAML SSO Requirements for Identity Providers. Checked 2026-09-25.
[^51]: Cisco Collaboration SAML SSO supports SAML 2.0 service-provider-initiated SSO only. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_requirements-for-identity-providers.html), SAML SSO Requirements for Identity Providers. Checked 2026-09-25.
[^52]: A successful SSO test in the Unified CM wizard reports 'SSO Test Succeeded!'. Source: [Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/216948-configure-saml-sso-on-cisco-unified-comm.html), Verify. Checked 2026-09-25.
[^53]: The SSO test user must be an LDAP-synchronised user with Standard CCM Super User permissions. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Enable SAML SSO for Cisco Collaboration Applications > procedure step 9; Update IdP Metadata. Checked 2026-09-25.
[^54]: Cisco lists AD FS 2.0 to 5.0, Microsoft Entra ID, Okta, OpenAM, PingFederate and F5 BIG-IP as IdPs tested with Cisco Collaboration SAML SSO. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML-Based SSO Solution](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_b_saml-sso-deployment-guide-12_5_chapter_01.html), Identity Provider (IdP) list of tested IdPs. Checked 2026-09-25.
[^55]: Before and after enabling or disabling SAML SSO, restart Cisco Tomcat with 'utils service restart Cisco Tomcat' on all Unified CM and IM and Presence cluster nodes where SSO runs. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Restart Cisco Tomcat Service. Checked 2026-09-25.
[^56]: The IdP must send a claim named uid whose value maps to the LDAP attribute used as the Unified CM user ID, for example sAMAccountName. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_requirements-for-identity-providers.html), SAML SSO Requirements for Identity Providers. Checked 2026-09-25.
[^57]: When IdP metadata changes, sign in through the recovery URL, choose System > SAML Single Sign On, click Update IdP Metadata File, import the new file, run the SSO test with a Standard CCM Super User and click Finish. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Update IdP Metadata. Checked 2026-09-25.
[^58]: Updating IdP metadata in cluster-wide mode restarts the Cisco Tomcat, Cisco SSOSP Tomcat and Cisco UDS Tomcat services on all cluster nodes. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Update IdP Metadata > note. Checked 2026-09-25.
[^59]: 'utils sso disable' disables SAML SSO from the CLI and returns sign-in to local authentication. Source: [Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/217268-configure-and-troubleshoot-sso-on-cisco.html), Troubleshoot > CLI commands. Checked 2026-09-25.
[^60]: 'utils sso status' shows the current SSO configuration including metadata import and SSO test status. Source: [Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/217268-configure-and-troubleshoot-sso-on-cisco.html), Troubleshoot > CLI commands. Checked 2026-09-25.