Configure Single Sign-On (SSO) with Your Own Identity Provider

Use your choice of a third-party identity provider solution for reps to log in to Voice from the Omni-Channel widget. For example, if your org uses Microsoft Azure as an identity provider, you can configure your contact center to require reps to log in and out of Azure’s single sign-on page from Omni-Channel.

Required Editions

This article applies to:

  • Salesforce Voice with Amazon Connect
  • Salesforce Voice with Partner Telephony
  • Salesforce Voice with Partner Telephony from Amazon Connect
View supported editions.
User Permissions Needed
To view the Amazon Contact Centers page:

Customize Application AND Manage Call Centers

OR

Salesforce Voice Delegated Contact Center Admin

To create and manage a contact center:

Salesforce Voice Contact Center Admin

OR

Salesforce Voice Delegated Contact Center Admin

To view the Partner Telephony Contact Centers page:

Customize Application AND Manage Call Centers

OR

Salesforce Voice Delegated Contact Center Admin

To create and manage a contact center:

Salesforce Voice Contact Center Admin (Partner Telephony)

OR

Salesforce Voice Delegated Contact Center Admin

The process for setting up a third-party identity provider solution to log in to Salesforce Voice varies based on your telephony provider. Work with your telephony provider to verify the procedure.

  1. From Setup, enter Contact Centers in the Quick Find box.
    • For Salesforce Voice with Amazon Connect, select Amazon Contact Centers.
    • For Salesforce Voice with Partner Telephony from Amazon Connect and Salesforce Voice with Partner Telephony, select Partner Telephony Contact Centers.
  2. Click the contact center name for which you want to enable your third-party identity provider.
  3. In the contact center details page, configure your identity provider.
    When you click Telephony Settings on the contact center details page, the third-party identity provider logs you in to your telephony provider. When a rep sets themselves as available in the Omni-Channel widget, the identity provider logs them in to your telephony provider behind the scenes.
Note
Note For Salesforce Voice with Amazon Connect, Salesforce creates and manages your AWS account. In this managed architecture, standard SAML 2.0 Federation is the only supported method for authentication. Reps log in directly through a Salesforce connected app or identity provider (such as Okta or Microsoft Entra ID) using an AWS IAM role, without requiring background user syncing.

These configurations aren’t supported.

IAM Identity Center (AWS SSO): AWS IAM Identity Center can’t be enabled for individual AWS accounts. Service Control Policies (SCPs) block IAM Identity Center permissions.

SCIM Provisioning: Salesforce doesn't support SCIM endpoints, tokens, or automated user or group provisioning for AWS accounts. So third-party SCIM deprecations don't affect these accounts.

Before proceeding to Voice on the Omni-Channel widget, reps log in to a single sign-on window. To log out of Voice, reps click Log Out of Phone System from Omni-Channel and are redirected to a log out page on Amazon Connect or your third-party telephony provider. When reps are logged out of their phone system, a message appears in Omni-Channel that they must refresh their browser to log in again.