This guide covers how to migrate SSO & SCIM configuration from the Udemy Business (Legacy) Okta app to the latest Udemy Business Okta app and is only relevant to you if your Okta SSO connection is configured using the Udemy Business (Legacy) app. The Udemy Business (Legacy) app will be deprecated at the end of the year.

• If you don't have an existing SSO connection with the Udemy Business (Legacy) Okta app but instead have an existing SSO connection with the Udemy Business Okta app, and are looking to complete your SSO reconfiguration, please review this guide.

Table of contents

• Before you begin 
• Choose your path
• Path A: Migrate without SCIM
  • Step 1: Set up the new Udemy Business app in Okta
  • Step 2: Reconfigure SSO in Udemy Business
• Path B: Migrate with SCIM
  • Step 1: Disable provisioning
  • Step 2: Set up the new Udemy Business app in Okta
  • Step 3: Reconfigure SSO in Udemy Business
  • Step 4: Configure SCIM on the new app and import users and groups
  • Step 5: Remove the legacy app

Before you begin

You will need:

• Administrator access to both your Udemy Business account and your Okta organization.
• A short maintenance window. SSO will be unavailable for a few minutes during the migration, so we recommend scheduling outside peak usage hours and notifying your learners.
• If you use SCIM provisioning on the legacy Okta app, allow extra time, additional steps are required to preserve user and group sync (see Path B below).

Important: Avoid lockout

Do not enable Login via SSO Provider Only until you have successfully tested the new connection end-to-end. If SSO is not properly configured, all users in your organization will be locked out of Udemy Business. You may disable this option while carrying out the reconfigure flow, please proceed to the instructions below.

Choose your path

• Path A: Migrate without SCIM: Your organization signs users in via SSO but does not use SCIM provisioning on the legacy Okta app.
• Path B: Migrate with SCIM: Your organization uses both SSO and SCIM provisioning on the legacy Okta app.

If you're not sure, check your Okta admin panel: open the Udemy Business (Legacy) app and look at the Provisioning tab and look under Integration. If provisioning is enabled, follow Path B.

Path A: Migrate without SCIM

Step 1: Set up the new Udemy Business app in Okta

In Okta, add the new app and prepare its metadata. Follow Steps 1-3 in this Help Center article.

Step 2: Reconfigure SSO in Udemy Business

Navigate to Step 4 in this Help Center guide.

• Follow Steps 4.1 and 4.2.
• Skip Steps 4.3 and 4.4. Select Reconfigure SSO instead of Start Setup. Okta and SAML are already selected based on your prior connection.
• Important: If you have SSO-only login selected while editing the settings, deselect it before hitting save. This prevents you from being fully locked out of your account in case there's an issue with your new SSO settings. You can enable it again when you have successfully tested the new SSO connection.
• Follow Steps 4.5, 4.6 and 4.7

Your organization is now using the new SSO experience through the new Udemy Business Okta app.

Path B: Migrate with SCIM

This path applies if your organization uses both SSO and SCIM provisioning on the legacy Okta app.

Step 1: Disable provisioning

In Okta, open the Udemy Business (Legacy) app, go to the Provisioning tab, and disable provisioning. Check under Integration in order to disable provisioning.

Users will remain in Udemy Business but will no longer be SCIM-managed. SCIM will be re-enabled on the new app in Step 3.

Step 2: Set up the new Udemy Business app in Okta

In Okta, add the new app and prepare its metadata. Follow Steps 1-3 in this Help Center article.

Step 3: Reconfigure SSO in Udemy Business

Navigate to Step 4 in this Help Center guide.

• Follow Steps 4.1 and 4.2.
• Skip Steps 4.3 and 4.4. Select Reconfigure SSO instead of Start Setup. Okta and SAML are already selected based on your prior connection.
• Important: If you have SSO-only login selected while editing the settings, please deselect it before hitting save. This prevents you from being fully locked out of your account in case there is an issue with your new SSO settings. You may enable it again when you have successfully tested the new SSO connection.
• Follow Steps 4.5, 4.6 and 4.7

Your organization is now using the new SSO experience through the new Udemy Business Okta app.

Step 4: Configure SCIM on the new app and import users and groups

Navigate to the section in this Help Center resource that outlines how to migrate an existing integration to bearer token to enable use of the new Udemy Business app in Okta.

• Follow Step 1
• For Step 2
  • Skip Steps 2.1 and 2.2. You've already configured the new app in a previous step.
  • Follows Steps 2.3 - 2.6
    • Set up your SCIM attributes so that they have parity with your setup in the legacy app
• Skip Step 3, you won't keep the old app once complete.
• Follow Steps 4 and 5

Step 5: Remove the legacy app

Once SSO sign-in and SCIM provisioning are both working on the new app and you're satisfied with the setup, deactivate or delete the Udemy Business (Legacy) app in Okta.

This article outlines how organizations can reconfigure their existing SSO connection from the legacy experience. 

Important note: your SSO connection must be reconfigured before the date specified in the outreach email that was sent to your organization. If you have any questions about your account’s status or the date that was provided, please contact your Customer Success representative or Udemy Business Support.

Why does our SSO connection need to be reconfigured?

In March, 2026, Udemy Business upgraded the infrastructure that powers single sign-on for Udemy Business. As part of this upgrade, existing SSO connections will need to be reconfigured using the new configuration experience.

This is an infrastructure-level change - your team's day-to-day login experience will remain the same once reconfiguration is complete.

How can we know if we need to reconfigure our SSO connection?

To check if you need to update your organization’s SSO connection, navigate to Manage > Settings > Single sign-on (SSO). If you need to reconfigure your connection, you’ll see a Reconfigure SSO banner and a Reconfigure SSO button. 

If you see an Edit connection button and don't see a Reconfigure SSO banner, your organization is already using the standard experience, and you don’t need to take any action.

Capabilities and details

How to reconfigure your SSO connection

1. In your SSO settings In Udemy Business, navigate to Admin Tools → Settings → Single sign-on. You'll see a prompt to reconfigure your connection in the top right hand corner of your current connection overview.
2. Start the new configuration: Click the reconfiguration prompt to enter the edit settings experience.
   • Important note: Before you save, check if SSO-only login is enabled. If your organization has SSO-only login enabled, temporarily disable it before hitting save on your new SSO settings. If the new connection doesn't work as expected, SSO-only login can lock all users out with no way to recover. Re-enable it once your new connection is tested and confirmed working.
3. Follow the guided setup for your IdP: See step-by-step instructions for:
   • Azure
   • Okta
   • OneLogin
   • ADFS
   • Google Workspace
   • Custom identity providers

Reverting to your previous configuration

A revert option is available if you experience authentication issues after reconfiguring, for example users are unable to log in, you can revert to your previous connection while you troubleshoot. To do so, go to Admin Tools > Settings > Single sign-on and click Revert to previous in the top right corner of your connection overview. Once you've resolved the issue, you can reconfigure again at any time.

Need help?

If you have questions or run into issues, contact our support team. 

Note: If your SSO connection was originally set up by Udemy's team (a managed connection), you won't be able to reconfigure it directly from the self-serve UI. Please contact your Customer Success Manager or our support team to schedule your migration.

Udemy Business supports Single Sign-On (SSO) with any provider that supports SAML2.0.

Udemy Business admins can independently enable SSO for your organization’s Udemy Business account and manage the integration moving forward as required. In addition, we provide a number of optional settings, which can be used to customize your SSO configuration.

Note: If your organization joined Udemy Business before March 25, 2026, please see this article for information instead, while we transition customers to this new experience. 

Core Features

• Identity Provider (IdP) Initiated SSO
  • Users will be able to initiate the login process from their SSO dashboard.
• Service Provider (SP) Initiated SSO
  • Users will be able to access [your-subdomain.udemy.com] and initiate the login process.
• Just in Time (JIT) / Auto-Provisioning
  • Users authenticated through SSO will be provisioned to Udemy Business on their first login.
  • Please note: JIT-provisioned users will not receive an automatically-generated email invite to claim their Udemy Business license as they would if they were manually invited through the Udemy Business user management portal. We recommend your learning team send out a separate communication explaining how they can get access by logging in via their SSO provider.
• Reactivate Deactivated Users
• Assign Users to Groups in Udemy Business
  • Users can be assigned to Udemy groups via SSO.  
  • Please note: The group must already exist within Udemy for a user to be assigned to it via SSO only, and the group attribute must be sent as a claim in the SAML assertion. If you wish to create, remove, and edit group membership that can be done via SSO + SCIM.  
• Remove Users to Groups in Udemy Business with SAML: 
  • Note: To enable the group feature below for existing integrations, please contact Udemy Business Support.
  • When the groups attribute is not mapped, we will not modify group membership.
  • When groups contain a list of groups the user will be set to those groups, and removed from any groups not included.
  • When groups is an empty list, it will remove the user from all groups.
  • We won’t modify SCIM-managed groups, but for all other non-SCIM groups, we will follow the same rules given above.
  • If one of the values in the groups attribute doesn’t match the name of an existing group, that value is ignored.

Please note: 

• SSO integration is only available for Enterprise Plan users. 
• The SSO integration can only be configured by a licensed admin in your organization’s Udemy Business account.

Where to configure SSO

To set up and manage your organization’s SSO integration in your Udemy Business account, please do the following:

1. Log into your account and click Manage in the top right menu.
2. Select Settings.
3. Click Single sign-on (SSO) from the menu on the left.
4. If you don’t have an active integration, click the Start setup button and select which identity provider you want to integrate with.

Please review the applicable article below to guide you through setting up your SSO integration. Note: for assistance in setting up SSO with other/custom identity providers, please contact our support team.

• How to Configure SSO with Entra ID
• How to Configure SSO with ADFS
• How to Configure SSO with Okta
• How to Configure SSO with OneLogin
• How to Configure SSO with Google Workspace
• How to Configure a Custom SSO Connection
• Cohort learning: Review how to configure SSO for our cohort learning platform, Corp U.

Optional SSO settings

Once you’ve configured your SSO integration, you can access these options by clicking the Optional settings dropdown menu at the bottom of the page. 

Optional SSO settings include:

• Log in via SSO Provider only:
  All users will be forced to log in via SSO. If this option is not selected, users will be able to log in via SSO or their username and password.
  • Please note: It is advised that all new configurations start with optional SSO to ensure any errors in the configuration do not impact the current user accessibility.
• Custom redirect URL:
  Insert the URL of the page you wish your users to land on if an error occurs with your SSO connection.
• Session timeout:
  Set a time, after which, inactive users will be automatically logged out of Udemy Business.
• Single logout:
  When a user logs out of Udemy Business, they will be logged out of all SSO applications.
• Allow SSO auto-provisioning:
  New users logging in through SSO will be automatically provisioned with a license. Otherwise, only existing users and users that have been invited to the account will be allowed to log in and consume a license.
  • Use Case: This can be disabled when an admin wishes to manage user access directly.
• Allow deactivated users to be reactivated via SSO:
  Users that have been deactivated will be automatically reactivated when they log in again through SSO (if these users are also still provisioned with access via SSO).

How to pause or delete your  SSO connection

Access: Manage > Settings > Single sign-on (SSO).
*NOTE: Deleting a connection will remove all connection information, and cannot be recovered.

• Learn how to update your SAML Signing certificate.

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive.  Please copy paste directly from the list below to ensure proper formatting:

Attributes

This article outlines how to configure single sign-on (SSO) with Udemy Business for any identity provider that supports SAML 2.0 SSO.

Additional resources:

• An overview of Udemy Business SSO & core features
• Implementation guides for pre-configured IdPs (Okta, Azure, AD FS, OneLogin, Google Workspace)
• Download the Udemy Business SSO Metadata file.

Please note: SSO integration is only available with the Enterprise Plan.

Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we are currently working to transition all existing connections from the legacy experience. You can read about the legacy experience here. Please reach out to the Udemy Business support team if you have any questions.

Table of contents

• Configuration steps
  • Option A: Configure using SAML
    • Uploading Metadata information to Udemy
  • Option B: Configure using OIDC
• Testing your SSO connection

Configuration steps

1.  Log in to Udemy Business and navigate to Manage > Settings > Single Sign-On (SSO) > Configure SSO.
   
2. Select Configure SSO.
3. In the drop down, select Custom
   

Option A: Configure using SAML

1. Under connection types, select SAML.
   
2. Name your SSO configuration.
3. Copy your SP EntityID.
4. Go to your Identity  Provider and start the set up. 
5. Below are the Udemy SSO SAML values needed for most configurations:
   • Download the Udemy Business SSO Metadata file.
   • Identifier (Entity ID): Obtained from the Udemy SSO configuration page in your Udemy Admin portal
   • Reply URL (Assertion Consumer Service URL): https://sso.udemy.com/api/oauth/saml
   • Sign on URL: https://{{domain}}.udemy.com/
     
      
6. Confirm SAML attributes. Identity providers often provide these by default but you may wish to edit these attributes.

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive.  Please copy paste directly from the list below to ensure proper formatting:

Attributes

7. Give users permission to use the Udemy Application.
8. Download the Metadata file from your system, or copy the Metadata URL.

Uploading Metadata information to Udemy

1. Once you obtain your Metadata info, go back to your Udemy Business SSO setup page in Manage > Settings > Single Sign-On (SSO). 
   
2. Under Configure using, you can import your metadata info either by Metadata URL or Metadata info.
3. If you’re using the URL select Metadata URL and paste in the Metadata URL you previously copied and click Import metadata.
4. If you have the Metadata file, select Metadata file and Select file. Look for the file and click Open.
5. You should now see the metadata info appearing, once you confirm this, scroll down to the bottom of the page and click Save.
6. Your SSO connection is now enabled. You can verify the status on the Single sign-on (SSO) page, which will display the connection status, certificate expiration date, and options to edit or pause the connection.

Option B: Configure using OIDC

• Complete the set up in your Identity Provider.
• If asked by your Identity Provider,, enter the Udemy Redirect URI: https://sso.udemy.com/api/oauth/oidc
• Once set up is done in your Identity Provider, go back to your Udemy Portal and go to Manage > Settings > Single sign-on (SSO) and select Start setup, then custom
• Name your SSO configuration.

• Under Connection type select OIDC

  
  

  Enter the following values obtained from your Identity Provider
   

• Client ID: Obtained from your Identity Provider.
• Client Secret: Obtained from your Identity Provider
• Well-known URL: 
  • Often known as the Discovery Endpoint 
• Click Save.

Testing your SSO connection

Before rolling out SSO to your organization, we recommend testing the connection:

1. Open a private/incognito browser window.
2. Navigate to your Udemy Business login page.
3. Select the SSO connection you created and sign in with a test user account.
4. Confirm the user is authenticated and successfully redirected to Udemy Business.

This article outlines how to configure a custom SSO connection for OneLogin in SAML (Security Assertion Markup Language) and OpenID Connect (OIDC).

Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we are currently working to transition all existing connections from the legacy experience. You can read about the legacy experience here. Please reach out to the Udemy Business support team if you have any questions.

SAML

Review OneLogin’s custom SAML documentation.

1. In your OneLogin admin portal, navigate to Applications and click Add App.

2. Search for SAML Custom Connector (Advanced) and select the application.

3. Enter a Display Name and Description for the app and click Save.

4. Download the metadata file by clicking the More Actions dropdown menu and selecting SAML Metadata.

5. Navigate to the Configuration tab and enter these parameters:

• Audience (Entity ID): https://sso.udemy.com
• ACS (Consumer) URL Validator*: https://sso.udemy.com/api/oauth/saml
• ACS (Consumer) URL*: https://sso.udemy.com/api/oauth/saml

6. Assign the relevant users to your new application.

7. Within your Udemy Business account, navigate to Manage > Settings > Single sign-on (SSO).

• If you're creating a new connection from scratch, click the Start setup option and select the OneLogin IdP.
• If you're editing an existing connection, click Edit Connection.

For customers being required to update their connection, there will be a call to action to reconfigure your connection in place of the Edit Connection option.

8. Give your connection a name and select the SAML protocol option and Metadata File configuration option. Upload the file Metadata file you downloaded from your OneLogin account, then click Save.

Your connection should now be successfully created between your Udemy Business account and OneLogin.

OIDC

Review OneLogin’s custom OIDC documentation.

1. In your OneLogin admin portal, navigate to Applications and click Add App.

2. Search for OpenId Connect (OIDC) and select the application:

3. Enter a Display Name and Description for the app and click Save.

4. Navigate to the Configuration tab and enter the following parameters:

• Login URL: Your organization domain should be entered here
• Redirect URI: https://sso.udemy.com/api/oauth/oidc
• Post Logout Redirect URI: Your organization domain should be entered here

5. Navigate to the SSO tab and copy the the following fields:

• Client ID
• Client Secret

Click the Well-known Configuration link and copy the URL for the Well-known URL

6. Assign the relevant users to your new application.

7. Within your Udemy Business account, navigate to Manage > Settings > Single sign-on (SSO).

• If you're creating a new connection from scratch, click the Start setup option and select the OneLogin IdP.
• If you're editing an existing connection, click Edit Connection.

For customers being required to update their connection, there will be a call to action to reconfigure your connection on this place in place of the Edit Connection option.

8. Give your connection a name and select the OIDC protocol option and Well-known URL configuration option. Past e the the following field values from your OneLogin account:

• Client ID
• Client Secret
• Well-known URL

Your connection should now be successfully created between your Udemy Business account and OneLogin.

This guide covers how to configure Single Sign-On (SSO) between Okta and Udemy Business using either SAML 2.0 or OIDC.

• Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we are currently working to transition all existing connections from the legacy experience. You can read about the legacy experience here. Please reach out to the Udemy Business support team if you have any questions.
• Existing Okta and Udemy Business customers who wish to enable SCIM Provisioning in Okta should use this configuration guide.
• Learn how to configure advanced SSO settings on an organizational level.

Please note:

• Single sign-on and provisioning are available to Udemy Business Enterprise Plan customers only.
• Don’t enable Login via SSO Provider Only until you have successfully tested your connection. If SSO is not properly configured, all users will be locked out of Udemy Business.
• Users provisioned through Okta will not take up a license until they log into the Udemy Business application for the first time.
• SCIM provisioning changes can only be synced from Okta to Udemy Business, not the other way round.
• Users and groups managed by SCIM in Okta cannot be modified within the Udemy Business app - Okta is the single source of truth for user and group data.

Table of contents

• Before you begin
• Configuration Steps
• Option A: Configure using SAML
  • Step 1: Add the Udemy Business app in Okta
  • Step 2: Assign users and groups
  • Step 3: Configure user attributes and claims (Optional)
  • Step 4: Retrieve your Okta SAML metadata

• Option B: Configure using OIDC

  • Step 1: Create an OIDC app integration in Okta

  • Step 2: Assign users and groups

  • Step 3: Retrieve your Okta OIDC credentials

  • Step 4: Complete OIDC setup in Udemy Business

• Testing your SSO connection
• Need help?

  • Useful external resources

Before you begin

• You must have administrator access to both your Udemy Business account and your Okta organization.
• Decide which protocol to use: SAML or OIDC. If you’re unsure, check with your IT team. Both are fully supported.

Configuration Steps

Option A: Configure using SAML

Step 1: Add the Udemy Business app in Okta

1. In Okta, navigate to Applications from the sidebar.
2. Click Browse App Catalog.

3. Search for Udemy Business, then click Add Integration. 

• Note: Don’t select the Udemy Business (Legacy) app. 
   

  

4. On the Application General Settings - Required page, fill in the following values:
    

   

• Application label: Choose a name for the application (for example, Udemy Business.)
• Audience URI: https://sso.udemy.com
• Subdomain: Your Udemy Business subdomain (for example, if your login URL is demo.udemy.com, enter demo)
• Domain: udemy.com

• ACS URL: https://sso.udemy.com/api/oauth/saml

Note: These need to be exact (no trailing slashes).

5. Click Done.

Step 2: Assign users and groups

1. Go to the Assignments tab.
2. Click Assign and select the users or groups you want to have access to the Udemy Business application.

Step 3: Configure user attributes and claims (Optional)

1. Click the Sign On tab.
2. Select Configure profile mapping.
3. Click Add Attribute.
4. Complete these fields with the desired attribute you want to add:

5. Once you’ve added the desired attribute, go to Mappings.
6. Select Okta User to Udemy.

7. Map the Okta attribute  you want associated with the Udemy attribute.

   
   

8. Select Save Mapping and Apply updates.

Step 4: Retrieve your Okta SAML metadata

1. Go to the Sign On tab, scroll down to Metadata URL and copy it to your clipboard.

   
   

2. Go to your Udemy Admin Portal and go to the SSO Configuration screen by going to Manage > Settings > Single sign-on (SSO).
3. Under Start setup, select Okta.
4. Select connection type SAML. 
5. Configure Using: Metadata URL, paste the metadata URL from Okta, then click Import Metadata. 

6. Click the Save button.

   
   

7. Your SSO connection is now enabled. You can verify the status on the Single sign-on (SSO) page, which will display the connection status, certificate expiration date, and options to edit or pause the connection.

   
   

Option B: Configure using OIDC

Step 1: Create an OIDC app integration in Okta

For additional guidance, refer to Okta's official documentation on creating an OIDC app integration and the OpenID Connect & OAuth 2.0 API.

1. In Okta, navigate to Applications from the sidebar and click Create App Integration.

2. Select OIDC – OpenID Connect as the sign-in method, then select Web Application as the application type. Click Next.

   
   

    

3. Configure the OIDC Integration

• Application Integration Name: Enter a name for the application (for example, Udemy Business).
• Sign-in redirect URI: https://sso.udemy.com/api/oauth/oidc
• Sign-out redirect URI (optional): Your Udemy Business domain (for example, if your login URL is demo.udemy.com, enter demo.udemy.com).
• Grant type: Authorization Code

4. Click Save.

Step 2: Assign users and groups

1. Go to the Assignments tab.
2. Click Assign and select the users or groups you want to have access to the Udemy Business application.

Step 3: Retrieve your Okta OIDC credentials

1. On the next screen, you’ll see the app’s client id and secret. You’ll need to copy these to add to the settings in your Udemy instance.

   

2. For the Well Known URL for the configuration method, this is the standard Okta URL
   <your okta instance>/.well-known/openid-configuration

Step 4: Complete OIDC setup in Udemy Business

Return to the Udemy Business SSO configuration screen.

1. In the Name field, enter a name for this connection.
2. Select OIDC as the Connection type.
3. Enter the Client ID and Client Secret retrieved from Okta.
4. Under Configure using Well-known URL: Select Well-known URL, (<your okta instance>/.well-known/openid-configuration)
   and click Import metadata. 
5. Click Save.

Testing your SSO connection

Before rolling out SSO to your organization, we recommend testing the connection:

1. Open a private/incognito browser window.
2. Navigate to your Udemy Business login page at https://[your-subdomain].udemy.com.
3. Click Continue with SSO, select the connection you created, and sign in with a test user account.
4. Confirm the user is authenticated and successfully redirected to Udemy Business.

Need help?

• If you encounter any issues during setup, contact Udemy Business Support.
• To continue and set up SCIM Provisioning in Okta, refer to the Configure SCIM Provisioning With Okta guide.

Useful external resources

• Okta app catalog - Udemy Business integration
• Create an OIDC app integration - Okta Developer
• OpenID Connect & OAuth 2.0 - Okta Developer
• Manage SAML signing certificates - Okta Help Center

This guide covers how to configure Single Sign-On (SSO) between Microsoft Entra ID (formerly Azure AD) and Udemy Business using either SAML 2.0 or OIDC.

Please note:

• If you already have an instance of Entra configured with Udemy please review the Setting Up Additional Entra ID Instances for Udemy Business section of this article.
• If you're using the Gallery app, it is not SCIM compatible. If you plan to use SCIM, create a Non-gallery application instead.
• Single sign-on and provisioning are available to Udemy Business Enterprise Plan customers only.
• Do not enable Login via SSO Provider Only until you have successfully tested your connection. If SSO is not properly configured, all users will be locked out of Udemy Business.

Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we're currently working to transition all existing connections from the legacy experience. You can read about the legacy experience here. Please reach out to the Udemy Business support team if you have any questions. 

Table of contents

• Before you begin
• Configure Single Sign-On (SSO) with Entra ID

• Option A: Configure using SAML

  • Step 1: Configure Udemy Business as an Enterprise Application in Entra ID

  • Step 2: Navigate to SSO settings in Udemy Business

  • Step 3: Basic SAML Configuration in Entra ID

  • Step 4: User Attributes and Claims

  • Step 5: Give users permission to use the Udemy Application

  • Step 6: Upload Metadata file from Entra to Udemy

• Option B: Configure using OIDC

  • Step 1: Register Udemy Business as an app in Entra ID

  • Step 2: Complete OIDC setup in Udemy Business

  • Step 3: Assigning users and groups in Entra ID

• Testing your SSO connection
• Setting up additional Entra ID instances for Udemy Business
  • Obtain a Unique IdP Entity ID
  • Step 1:  Enable App ID to Issuer (Customer)
  • Step 2 : Add App ID to Metadata File (Udemy)

Before you begin

• You must have administrator access to both your Udemy Business account and your Microsoft Entra ID tenant.
• Decide which protocol to use: SAML or OIDC. If you’re unsure, check with your IT team. Both are fully supported.

Configure Single Sign-On (SSO) with Entra ID

Option A: Configure using SAML

Step 1: Configure Udemy Business as an Enterprise Application in Entra ID

1. Log in to your Entra portal and click Microsoft Entra ID.
2. Select Enterprise applications.
   
3. Click + New application in the top bar.
   
4. Select Create your own application. 
   
5. Enter a name for the new application and click Integrate any other application you don't find in the gallery (Non-gallery) at the end of the window.
   
6. Select Set up single sign on. 
   
7. For Single Sign-on mode, select SAML based Sign-on.
   

You should now see the configuration screen below

Step 2: Navigate to SSO settings in Udemy Business

1. Log in to your Udemy Business account as an admin.
2. Go to Manage > Settings > Single sign-on (SSO)
3. Click Start setup and select Azure as your identity provider.
4. Name your SSO Connection. The name you choose will be displayed for the SSO sign in option in the login page
   
5. Under Connection type select SAML, and copy the SP Entity ID.
   

Step 3: Basic SAML Configuration in Entra ID

1. Go back to your Entra ID configuration portal and In the Basic SAML Configuration section, click Edit and enter the following:

• Identifier (Entity ID): Obtained from the Udemy SSO configuration page in your Udemy Admin portal.
• Reply URL (Assertion Consumer Service URL): https://sso.udemy.com/api/oauth/saml
• Sign on URL: https://{{domain}}.udemy.com/

Step 4: User Attributes and Claims

Note: Udemy ignores the Unique User Identifier section in the required claims.

1. Go back to the Single Sign-on tab in the sidebar and click Edit on the Attributes & Claims section.
2. In the Additional Claims section, click on the user.mail value.

• Update emailaddress to “email” (make sure it is all lowercase)
• Delete the Namespace URI.
• For source attribute, make sure to select the email value you want to transfer from Entra ID to Udemy (usually user.mail or user.userprincipalname.) This will be the main identifier for the user's account and should match the email value in Udemy.
  

3. Add new claim or edit an existing claim and repeat the process.
4. Click Save.
5. To add further optional attributes, click Add new claim and repeat the process. Udemy Business supports the following SAML attributes. 

Please note: All attributes are space and case-sensitive. Copy and paste directly from the table below.

6. Once you’re done adding the attributes, click Save to complete the attribute configuration.

 Step 5: Give users permission to use the Udemy Application

1. Go back to the Set up Single Sign-On with SAML settings screen and click on Users and Groups on the left hand panel
   
2. Click on Add user/group.
3. Under Users, click on None Selected and search for the user or group you want to give permission to access the application.
4. 
5. When you selected the users or groups you wanted to add, click on Select in the bottom of the screen
6. Click Assign. Only these selected users or groups have permission to log into Udemy with SSO.

Step 6: Upload Metadata file from Entra to Udemy

1. Go back to the Set up Single Sign-On with SAML settings in Entra.
2. Scroll down to SAML Certificates.
3. Look for the App Federation Metadata URL and copy the link.
   
4. Once you’ve copied the Metadata URL, go back to your Udemy Business SSO setup page in Manage > Settings > Single Sign-On (SSO). 
   
5. Under Configure using, select Metadata URL and paste in the Metadata URL you previously copied, then click Import metadata.
6. You should now see the metadata data appearing, once you confirm this, scroll down to the bottom of the page and click Save.
7. Your SSO connection is now enabled. You can verify the status on the Single sign-on (SSO) page, which will display the connection status, certificate expiration date, and options to edit or pause the connection.
8. If you get the error message “Error while editing and enabling SSO connection”, this is likely caused by a duplicate IdP EntityID. Please follow the guide Setting Up Additional Entra ID Instances for Udemy Business to resolve this issue
   

Option B: Configure using OIDC

Step 1: Register Udemy Business as an app in Entra ID

For additional guidance, refer to Microsoft's official documentation on configuring OIDC SSO for custom applications and the OpenID Connect protocol on the Microsoft identity platform.

1. Sign in to the Microsoft Entra admin centre and navigate to More Services, then search for App registrations.
2. Click New registration and configure the following:
   • Name: Udemy Business (or a name of your choice)
   • Supported account types: Select the option appropriate for your organisation (typically Accounts in this organizational directory only)
   • Redirect URI: Select Web and enter “https://sso.udemy.com/api/oauth/oidc”

3. Click Register.
4. On the app overview page, copy the Application (client) ID. You will need this in Udemy Business.

5. Navigate to Certificates & secrets → Client secrets → New client secret.

6. Add a description, set an expiry period, and click Add. Copy the secret Value immediately - it will not be shown again.

Step 2: Complete OIDC setup in Udemy Business

Return to the Udemy Business SSO configuration screen.

1. In the Name field, enter a name for this connection.
2. Select OIDC as the Connection type.
3. Enter the following values:
   Client ID: Obtained the Application Overview in Entra labeled as “Application (client) ID”
   Client Secret: Obtained from the secret value you previously copied
   Well-known URL: 
   • Obtained by going to the overview screen and clicking on Endpoints. Copy the URL for “OpenID Connect metadata document”. Should look similar to : https://login.microsoftonline.com/[your-tenant-id]/v2.0/.well-known/openid-configuration
4. Click Save.

Step 3: Assigning users and groups in Entra ID

Once the connection is saved, assign the relevant users or groups to the Udemy Business application in Entra ID.

1. In the Entra admin centre, go to your Udemy Business enterprise application.
2. Select Users and groups, then click Add user/group.
3. Select the users or groups you wish to assign and click Assign.

Testing your SSO connection

Before rolling out SSO to your organization, we recommend testing the connection:

1. Open a private/incognito browser window.
2. Navigate to your Udemy Business login page.
3. Select the SSO connection you created and sign in with a test user account.
4. Confirm the user is authenticated and successfully redirected to Udemy Business.

Setting up additional Entra ID instances for Udemy Business

If you're configuring an additional Entra ID (Azure AD) instance to integrate with Udemy Business, follow the steps below to ensure a successful setup. Each SSO connection must use unique identifiers to avoid conflicts.

Obtain a Unique IdP Entity ID

To generate a unique IdP EntityID for each additional integration, you’ll need to enable the App ID URI in your Entra SAML settings.

Follow the instructions below to get a unique Entity ID from Azure AD (Entra ID) for each
separate Udemy Instance.

Step 1:  Enable App ID to Issuer (Customer)

1. Navigate to your Udemy Application in Entra. In the SAML settings, go to Attributes and Claims. 
2. Navigate to Advanced Settings.
3. Click Edit on Advanced SAML Claim Options.
4. Select the Append Application ID to Issuer flag and Save.

Step 2: Add App ID to Metadata File (Udemy)

1. Navigate back to your SAML Settings and go to SAML Certificates. Copy the App Federation Metadata URL.

2. Paste the URL into your browser window and copy the App ID.

3. Save the page as an XML File, or by going to the previous page and downloading the Federation Metadata XML.

4. Open the Metadata file in a text document and append the app ID next to the EntityID. You can use ctrl+f entityID to find the section.

5. For example, if the EntityID is: "https://sts.windows.net/728f03be-40cd-47a7-8ff3-58569e27d1c5/”

Update it to:

"https://sts.windows.net/728f03be-40cd-47a7-8ff3-58569e27d1c5/44234257-31f0-4928-9762-5913dd59dd36" 

6. Save the updated Metadata file.

7. Once you’ve copied the Metadata URL, go back to your Udemy Business SSO setup page in Manage > Settings > Single Sign-On (SSO). 

8. Under Configure using, select Metadata File and Select file. Look for the metadata file you edited then click Import metadata.

9. You should now see the metadata data appearing, once you confirm this, scroll down to the bottom of the page and click Save.

Your SSO connection is now enabled. You can verify the status on the Single sign-on (SSO) page, which will display the connection status, certificate expiration date, and options to edit or pause the connection.

In this tutorial, we'll configure ADFS with Udemy Business using the metadata from ADFS.

• Access the Udemy Business SAML Metadata for ADFS.
• Learn how to configure advanced SSO settings on an organizational level.
• Learn more about the provisioning features that are supported through single sign-in (SSO) with Udemy Business.
• Note: SSO integration is only available with the Enterprise Plan.

Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we're currently working to transition all existing connections from the legacy experience. You can read about the legacy experience here. Please reach out to the Udemy Business support team if you have any questions.

How to configure ADFS

1. Launch the ADFS 2.0 console. 

2. Under Trust Relationships > Relying Party Trusts, add a new Relying Party Trust. This will launch the wizard shown below.

3. You'll be prompted to import the Udemy Business Metadata file. Udemy Business SAML Metadata for ADFS is linked here.

4. Enter a name for the connection, for example Udemy Business. 

5. On the Choose Issuance Authorization Rules step, select Permit all users to access this relying party.

6. Click Next to view the summary and complete the wizard.

 7. Leave the “Open the Edit Claim Rules…” option checked and finish the wizard.

8. This will launch the Edit Claim Rules configuration utility.

9. This example will only gather claims from Active Directory to present to Udemy Business. 

10. Configure a basic claim set.

Attributes

Udemy Business supports the following SAML attributes. Note: all attributes are space and case sensitive).

Attributes

11. Once you’ve configured the claims, back on the ADFS 2.0 Relying Party Trusts window, right-click the newly created connection and view the properties for the connection. Navigate to the Encryption tab and remove the encryption certificate.

12. That will complete the ADFS configuration. Next, you should download the metadata and input it into your Udemy Business account to create the SSO connection.

You can find the Metadata file by inputting your server name and linking to the below:

https://<ADFS server name>/FederationMetadata/2007-06/FederationMetadata.xml

13. Access the Single Sign-On (SSO) tab of your Udemy Business account by going to Manage > Settings > Single Sign-on (SSO). 

14 .Click Start setup and ADFS. 

15. On Connection type, select SAML.

16. Under Configure using, you can choose Metadata URL or Metadata file.

17. Save the connection.

In this tutorial, we'll configure Google Workspace (formerly known as G Suite and Google Apps for Work). 

• Learn how to configure advanced SSO settings on an organizational level.
• Learn more about the provisioning features that are supported through single sign-in (SSO) with Udemy Business.
• Note: SSO integration is only available with the Enterprise Plan.

Note: 

• On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we're currently working to transition all existing connections from the legacy experience. You can read about the legacy experience here. Please reach out to the Udemy Business support team if you have any questions.

Step 1: Locate Your SaasID

To configure Google Workspace you will need your SaasID. This value will be provided by Udemy Business and it is going to be the sub domain to access Udemy, for example, the yoursubdomain where the Udemy Business full address is yoursubdomain.udemy.com.

In addition to your SaasID, you will also need the following parameters to configure Google Workspace.

• Identifier (Entity ID): https://sso.udemy.com
• Reply URL (Assertion Consumer Service URL): https://sso.udemy.com/api/oauth/saml
• Sign on URL: https://{{domain}}.udemy.com/

Step 2: Create a New SAML Application in Google Workspace

The steps below outline how to create a new SAML application in Google Workspace.

1. Log into Google Workspace admin console.
2. Navigate to Apps > Web and Mobile apps.

3. Click Add app > Add custom SAML app.

4. Enter the Application Name and Description, upload a logo if desired, then click Continue.

5. Click on the Download Metadata under Option 1 and click Continue.

6. Fill in the ACS URL, Entity ID, Start URL, and Name ID with the property values below, then click Continue.

• ACS URL: https://sso.udemy.com/api/oauth/saml
• Entity ID: https://sso.udemy.com

7. Add the attributes exactly as seen in the screenshot below.

• (Optional) Add Users to Groups via SAML Assertion
  To assign users to groups through SAML assertions, include the groups attribute under the Group Membership section.
• Important:
  • Ensure the groups you wish to assign are already created in Udemy.
  • Use the Search for a group field to select and add the desired groups. Any groups not added in this section will not be passed to Udemy.

8. Click Finish to complete the wizard.

9. By default, new applications are OFF for all users. To turn this on, go back to Apps > Web and mobile apps and click User Access.

10. In Service status, change the toggle to ON for everyone, then click Save.

11. Enter the metadata file created in Step 5 into your Udemy Business account to create the SSO connection.

12. In Udemy Business, access the Single Sign-On (SSO) tab. Select Start setup > Google Workspace.

13. Give your connection a name, select SAML and Metadata file, and upload the metadata file downloaded in Step 5. Click Save.

Please note: when adding a new SAML application in Google Workspace, it might take up to 24 hours for the process to be completed.

Once the SAML application is created, you’ll need to configure attributes that are going to be sent in the SAML assertion.

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive. Please copy paste directly from the list below to ensure proper formatting:

Attributes

If your organization is moving to a new Identity Provider (IdP) for Single Sign-On (SSO), this guide explains how to update your SSO configuration in Udemy Business, and help ensure a transition with minimal disruption to your users.

Pre-migration checklist

Before you update your SSO settings in Udemy Business, make sure you:

• Have admin access to the Udemy Business Admin Portal.
• Ensure your users main identifier remain consistent (email address, externalID).
• Ensure the EntityID you provide Udemy is not currently in use in another connection.
• Have access to the new IdP’s metadata or configuration details.
• Have access to your previous IdP’s metadata as backup.

How to migrate your IdP in Udemy Business

Step 1: Delete your current SSO integration

• Go to your Udemy Admin portal.
• Go to Manage > Settings > SSO > Delete Connection.

Step 2: Follow the SSO Set up guide from your new Identity Provider

• Okta SSO Configuration Guide
• Azure AD (Entra ID) SSO Configuration Guide
• Google Workspace SSO Configuration Guide
• One Login SSO Configuration Guide
• ADFS SSO Configuration Guide
• Other/Custom SSO Configuration Guide

Step 3: Test login

• When attempting to log in after the set up, make sure to use an incognito window to make sure the previous login is not cached.

Common errors & how to resolve them

Frequently asked questions

Will this affect existing Udemy user accounts?
As long as the email addresses stay the same, existing user accounts will remain intact and licenses will not be lost.

Do we need to reassign licenses?
No, user licenses are tied to email addresses. If the main identifier remains the email, users retain their licenses.

How do we revert to the old IdP if something goes wrong?
If you've saved your old IdP metadata or settings, you can re-upload them to revert. Please contact Udemy Business Support if you need help.

Will this affect my users' learning history?
A Udemy users’ learning history is tied to their email address. As long as the email addresses do not change, the learning history will be unaffected.

Udemy Business supports Single Sign-On (SSO) with any provider that supports SAML2.0.

Udemy Business admins can independently enable SSO for your organization’s Udemy Business account and manage the integration moving forward as required. In addition, we provide a number of optional settings, which can be used to customize your SSO configuration.

Core Features

• Identity Provider (IdP) Initiated SSO
• Users will be able to initiate the login process from their SSO dashboard
• Service Provider (SP) Initiated SSO
• Users will be able to access [your-subdomain.udemy.com] and initiate the login process.
• Just in Time (JIT) / Auto-Provisioning
• Users authenticated through SSO will be provisioned to Udemy Business on their first login.
• Please note: JIT-provisioned users will not receive an automatically-generated email invite to claim their Udemy Business license as they would if they were manually invited through the Udemy Business user management portal. We recommend your learning team send out a separate communication explaining how they can get access by logging in via their SSO provider.
  
• Reactivate Deactivated Users
• Assign Users to Groups in Udemy Business
• Users can be assigned to Udemy groups via SSO.  
• Please note: The group must already exist within Udemy for a user to be assigned to it via SSO only, and the group attribute must be sent as a claim in the SAML assertion.  If you wish to create, remove, and edit group membership that can be done via SSO + SCIM.  
• Remove Users to Groups in Udemy Business with SAML: 
  • Note: To enable the group feature below for existing integrations, please contact Udemy Business Support.
  • When the groups attribute is not mapped, we will not modify group membership.
  • When groups contain a list of groups the user will be set to those groups, and removed from any groups not included.
  • When groups is an empty list, it will remove the user from all groups.
  • We will not modify SCIM-managed groups, but for all other non-SCIM groups, we will follow the same rules given above.
  • If one of the values in the groups attribute does not match the name of an existing group, that value is ignored.

Please note: 

• SSO integration is only available for Enterprise Plan users. 
• The SSO integration can only be configured by a licensed admin in your organization’s Udemy Business account.

Where to configure SSO

To set up and manage your organization’s SSO integration in your Udemy Business account, please do the following:

1. Log into your account and click Manage in the top right menu.
2. Select Settings.
3. Next, click Single sign-on (SSO) from the menu on the left.
4. If you don’t have an active integration, click the Start setup button and select which identity provider you want to integrate with.

Please review the applicable article below to guide you through setting up your SSO integration. Note: for assistance in setting up SSO with other/custom identity providers, please contact our support team.

• How to Configure SSO with Azure AD
• How to Configure SSO with ADFS
• How to Configure SSO with Okta
• How to Configure SSO with OneLogin
• How to Configure SSO with Google Workspace
• How to Configure a Custom SSO Connection
• Cohort learning: Review how to configure SSO for our cohort learning platform, Corp U.

Optional SSO settings

Once you’ve configured your SSO integration, you can access these options by clicking the Optional settings dropdown menu at the bottom of the page. 

• Please note: if you encounter a notification stating your account is not compatible with our self-serve SSO feature, and wish to modify any of the optional settings, please contact Udemy Support.

Optional SSO settings include:

• Log in via SSO Provider only:
  All users will be forced to log in via SSO. If this option is not selected, users will be able to log in via SSO or their username and password.
• Please note: It is advised that all new configurations start with optional SSO to ensure any errors in the configuration do not impact the current user accessibility.
• Custom redirect URL:
  Insert the URL of the page you wish your users to land on if an error occurs with your SSO connection.
• Session timeout:
  Set a time, after which, inactive users will be automatically logged out of Udemy Business.
• Single logout:
  When a user logs out of Udemy Business, they will be logged out of all SSO applications.
• Allow SSO auto-provisioning:
  New users logging in through SSO will be automatically provisioned with a license. Otherwise, only existing users and users that have been invited to the account will be allowed to log in and consume a license.
• Use Case: This can be disabled when an admin wishes to manage user access directly.
• Allow deactivated users to be reactivated via SSO:
  Users that have been deactivated will be automatically reactivated when they log in again through SSO (if these users are also still provisioned with access via SSO).

How to pause or delete your  SSO connection

Access: Manage > Settings > Single sign-on (SSO).
*NOTE: Deleting a connection will remove all connection information, and cannot be recovered.

• Learn how to update your SAML Signing certificate.

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive.  Please copy paste directly from the list below to ensure proper formatting:

Attributes

email 

firstName 

middleName 

lastName 

displayName 

Name ID

groups 

externalID

lmsUserID 

licenseTypes 

licensePoolName

This article outlines how to configure single sign-on (SSO) with Udemy Business for any identity provider that supports SAML2.0 SSO.

Note:  

• On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we're currently working to transition all existing connections from the legacy experience. You can read about the now standard experience here. Please reach out to the Udemy Business support team if you have any questions.

Additional resources:

• An overview of Udemy Business SSO & core features
• Implementation guides for pre-configured IdPs (Okta, Azure, AD FS, OneLogin, Google Workspace)

Please note: SSO integration is only available with the Enterprise Plan.

How to configure SSO 
 

Pre-requisites

1. Download the Udemy Business SSO Metadata file.

2. You are an Admin within your Udemy environment.

Part 1 - Setting up Udemy Business as a Service Provider

For specific instructions in establishing a SSO connection in your system we recommend consulting your documentation

3. Use the provided UB metadata file to configure SSO within your Identity provider by saving the file or copying the URL. This process differs per identity provider so please refer to the particular Identity provider article for details.

4. Confirm SAML configuration values:

Entity ID: PingConnect
ACS URL: https://sso.connect.pingidentity.com/sso/sp/ACS.saml2
Logon/Base URL: Your Udemy Environment URL.({company}.udemy.com)
Relay State (optional): https://pingone.com/1.0/d905a6ca-adf9-45e2-9b9d-0d6485f27206
X509 Certificate: Found in Udemy metadata file

Please note:  If you are already using PingConnect as an Entity ID for another existing SSO application, please contact Udemy to create a unique Entity ID and generate a custom metadata file.

5. Confirm SAML attributes. Identity providers often provide these by default but you may wish to edit these attributes.

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive.  Please copy paste directly from the list below to ensure proper formatting:

email 

firstName 

middleName 

lastName 

displayName 

Name ID

groups 

externalID

lmsUserID 

licenseTypes 

licensePoolName

6. Download the Metadata file from your system

Part 2 - Configuring Udemy

1. Login to Udemy Business

2. Manage > Settings > Single Sign-On (SSO) > Start setup, and select Custom.

3. Connection Name: This can be anything (e.g. CSOD SSO).

4. Import the Metadata via URL or from the file you previously downloaded from your system.

5. Confirm Configuration

• Verify that all parameters are correct for your environment.

6. Save. A banner will display in the lower right if the settings are successfully applied.

Your SSO Configuration is complete!  You can now provision users for Udemy Business in your SSO tenant.  

If you wish to configure SCIM, please review Configure SCIM Provisioning With Udemy’s SCIM API.

This guide provides the steps required to configure Single Sign-On (SSO) using Security Assertion Markup Language (SAML 2.0) for Udemy Business.

• Access Udemy Business SAML Metadata for Azure AD.
• Cohort learning: Review how to configure SSO for our cohort learning platform, Corp U.

Please note: 

• Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we're currently working to transition all existing connections from the legacy experience. You can read about the now standard experience here. Please reach out to the Udemy Business support team if you have any questions.

• If you are using the Gallery app, please keep in mind that it is not SCIM compatible. If you are planning to use SCIM, please create a Non-gallery application.
• If you already have an instance of Entra configured with Udemy please review the Setting Up Additional Entra ID Instances for Udemy Business section of this article

Configure Single Sign-On (SSO) with Azure

Log in to your Azure portal and click Microsoft Entra ID.

Next, select Enterprise applications.

 Now click + New application in the top bar.

 Select Create your own application.

Enter a name for the new application and click Integrate any other application you don't find in the gallery (Non-gallery) at the end of the window.

Then select Set up single sign on. 

For Single Sign-on mode, select SAML based Sign-on.

Follow the 3 steps on the Set up Single Sign-On with SAML screen. Azure AD has also provided a detailed configuration guide at the top of the page for further guidance.

For Step 1, Basic SAML Configuration:

• In the Identifier (Entity ID) field, enter https://www.udemy.com/sso/saml.

Please note: If the Entity ID is being used by another SSO application, please contact Udemy Business to create a unique Entity ID and generate a custom metadata file.

• In Reply URL field, enter this value: https://sso.connect.pingidentity.com/sso/sp/ACS.saml2
• In Sign on URL field, enter your Udemy Business account URL: https://{yoursubdomain}.udemy.com
• Relay State (Optional): https://pingone.com/1.0/d905a6ca-adf9-45e2-9b9d-0d6485f27206
• Logout URL (Optional): If you decide to configure Single Logout, enter the following: https://sso.connect.pingidentity.com/sso/SLO.saml2

Once all these fields are added, click Save.

For Step 2, User Attributes and Claims:

Go back to the Single Sign-on tab in the sidebar and click “Edit” on the Attributes & Claims” section.

In the Additional Claims section, click on the user.mail value.

• Update emailaddress to “email” (make sure it is all lowercase)
• Delete the Namespace URI
• For source attribute, make sure to select the email value you want to transfer from Azure AD to Udemy. This will be the main identifier for the users account.

To add more optional attributes (Additional claims) to your SAML assertion, click Add new claim or edit an existing claim and repeat the process:

Once you’re done adding the attributes, click Save to complete the attribute configuration.

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive.  Please copy paste directly from the list below to ensure proper formatting:

email 

firstName 

middleName 

lastName 

displayName 

Name ID

groups 

externalID

lmsUserID 

licenseTypes 

licensePoolName

For Step 3, in the SAML Signing Certificate section, click Download next to Federation Metadata XML, which will export the Metadata file.

Once you have downloaded the Metadata file, go to the Udemy Business SSO setup in Manage > Settings > Single Sign-On (SSO). Click Start setup and choose your Identity Provider (Azure in this case).

On the Udemy Business account SSO configuration page, name your connection, upload the metadata XML file you downloaded from Azure, and configure any desired Optional SSO Settings.

For additional details on the optional SSO settings, you can review our article on Configuring SSO with your Identity provider page:

Please note:  Do not enable Login via SSO Provider Only until you’ve tested your connection successfully.  If SSO is not properly configured, all users will be locked out of Udemy Business.

Click Save.

Your SSO connection is now enabled.

• You can now configure your user and group management for Udemy Business directly within your Azure tenant.  For a high-level overview, please reference the steps below in Adding Users and Groups to Udemy Business in Azure.
• Learn how to configure SCIM Provisioning With Azure Active Directory (AD).

Adding Users and Groups to Udemy Business in Azure

Click on Azure Active Directory.

Select Enterprise applications.

Select your newly created application from the list.

Click Users and groups.

Click on Add User -> Users and Groups

Select all users you want to add to the application. Then, click Select.

You have now completed configuring SSO for Udemy Business with Azure AD.

Setting up additional Entra ID instances for Udemy Business

If you're configuring an additional Entra ID (Azure AD) instance to integrate with Udemy Business, please follow the steps below to ensure a successful setup. Each SSO connection must use unique identifiers to avoid conflicts.

1. Obtain a Unique IdP Entity ID

To generate a unique IdP EntityID for each additional integration, you’ll need to enable the App ID URI in your Entra SAML settings.

Follow the instructions below to get a unique Entity ID from Azure AD (Entra ID) for each
separate Udemy Instance.

Step 1 - Enable App ID to Issuer (Customer)

1. Navigate to your Udemy Application in Entra. In the SAML settings go to Attributes and Claims. 
2. Navigate to Advanced Settings.
3. Edit Advanced SAML Claim Options.
4. Tick “Append Application ID to Issuer” flag and Save.

Step 2 - Add App ID to Metadata File (Udemy)

1. Navigate back to your SAML Settings and go to SAML Certificates. Next, copy the App Federation Metadata URL.

2. Paste the URL into your browser window and copy the App ID.

3. Save the page as an XML File, or by going to the previous page and downloading the Federation Metadata XML.

4. Open the Metadata file in a text document and append the app ID next to the EntityID. You can use ctrl+f entityID to find the proper section.

5. For example, if the EntityID is: "https://sts.windows.net/728f03be-40cd-47a7-8ff3-58569e27d1c5/”

Update it to:

"https://sts.windows.net/728f03be-40cd-47a7-8ff3-58569e27d1c5/44234257-31f0-4928-9762-5913dd59dd36" 

6. Save the updated Metadata file.

2. Obtain a Unique SP Entity ID

Each Entra ID (Azure AD) integration with Udemy must have its own unique SP EntityID.

• After creating the new IdP EntityID with the App ID appended to the metadata file, please share the updated metadata file with Udemy Support. Additionally, be sure to include a comprehensive list of all Udemy/Entra SP EntityIDs currently configured for your other environments. This will help us ensure consistency and avoid configuration conflicts across environments.
• The Udemy team will then upload your Metadata file and create the SSO connection. Then we will provide you with the unique SP EntityID.

Please note:

• Single sign-on and provisioning are available to Udemy Business Enterprise Plan customers.
• Users provisioned through Azure AD will not take up a license until they log into the Udemy Business application for the first time. 
• SCIM provisioning changes can only be synced from Azure AD to Udemy Business, not the other way round. 
• Users and Groups managed by SCIM in Azure AD cannot be changed within the Udemy Business app - SCIM is the single source of truth for user and group data.
• You can still create groups manually in Udemy Business if you have users that you don’t need or want to push from Azure AD, eg. contractors or temporary staff.

This guide provides the steps required to configure Single Sign-On using Security Assertion Markup Language (SAML 2.0) and Provisioning using System for Cross-domain Identity Management (SCIM 2.0) for Udemy Business.

Note: 

• Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we are currently working to transition all existing connections from the legacy experience. You can read about the now standard experience here. Please reach out to the Udemy Business support team if you have any questions.

• Existing Okta and Udemy Business customers who wish to enable SCIM Provisioning in Okta should use this configuration guide.
• Learn how to configure advanced SSO settings on an organizational level.
• Cohort learning: Review how to configure SSO for our cohort learning platform, Corp U.

Please note:

• Single sign-on and provisioning are available to Udemy Business Enterprise Plan customers.
• Users provisioned through Okta will not take up a license until they log into the Udemy Business application for the first time.
• SCIM provisioning changes can only be synced from Okta to Udemy Business, not the other way round.
• Users and Groups managed by SCIM in Okta cannot be changed within the Udemy Business app - SCIM is the single source of truth for user and group data.

Table of contents

• Supported SAML attributes
• Configuration Steps

Features

Learn more about the provisioning features that are supported through single sign-in (SSO) with Udemy Business. 

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive and do not include the colon.  Please copy paste directly from the list below to ensure proper formatting:

email 

firstName 

middleName

lastName 

displayName

Name ID

groups 

externalID 

lmsUserID 

licenseTypes

licensePoolName

Configuration Steps

1. To get started, log into your Udemy Business account and go to the User Access page from Manage > Settings > Single Sign-On (SSO).

Click Start setup. Choose your Identity Provider and follow the instructions from there to enable SCIM, and generate your credentials for inputting into your Identity Provider, as part of the configuration process.

2. From your Okta,  access the Applications page from the sidebar.

3. Click on Browse App Catalog, search for Udemy Business and click Add Integration.

4. Adding the Udemy Business app will redirect you to the Application General Settings - Required page as shown below. Choose a name for your Application label and fill in the values below

Application Label: Choose a name for the application
Audience URI (SP Entity ID): PingConnect (If you have any issues with this value, reach out to Udemy Business Support)
Subdomain: (if your login url is demo.udemy.com put demo)
Domain: udemy.com

Click Done.

5. Next, click the Sign On tab then Edit.

Scroll down to Default Relay State and add

https://pingone.com/1.0/d905a6ca-adf9-45e2-9b9d-0d6485f27206 and Save.
 

6. Go to the Assignments Tab and Assign the users or groups you want access to the Udemy Application

7. On the same page, scroll down to SAML Signing Certificates. Click on Actions then View IdP metadata.  Copy the metadata URL to your clipboard.  

(Alternatively, you can select the Download certificate to download the metadata file to your computer).

Supported features

The Okta/Udemy Business SAML integration currently supports the following features:

• IdP-initiated SSO
• SP-initiated SSO
• JIT (Just In Time) Provisioning

How to add SAML attributes

Optional Step: You can follow these optional instructions to add specific attributes for more customization of your Udemy Business app integration with Okta. If you prefer to skip this, please proceed to the next step.

Here is an example describing how to add and use the additional licensePoolName attribute:

How to add SAML attributes

Optional Step: You can follow these optional instructions to add specific attributes for more customization of your Udemy Business app integration with Okta. If you prefer to skip this, please proceed to the next step.

Here is an example describing how to add and use the additional email attribute:

In your Okta Udemy Application, go to Sign On then Edit.

Look for the Attributes (Optional) setting and hit the drop down.
The name value will be the Udemy Attribute name and the Value will be the Okta attribute name. If we want to map email to user.email we will set the name as email and the value to be user.email. Click Save.

8. Navigate back to your Udemy Business account and access the Single sign-on (SSO) settings. On the configuration page, choose the appropriate metadata configuration method, and follow the instructions to create the SSO connection with your Identity Provider and Udemy Business.

Please note: If you are looking to enable Login via SSO provider only within Optional settings, please ensure your SSO is properly working by logging out and logging back in via SSO, before enabling this feature. Otherwise, you may be locked out of your Udemy Business account.

9. Click Save. SSO setup is now complete!

If you wish to continue and set up SCIM Provisioning in Okta please use this configuration guide.

For SP-initiated SSO

1. Go to: https://[your-subdomain].udemy.com. 

2. Click Continue with SSO.

Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we're currently working to transition all existing connections from the legacy experience. You can read about the now standard experience here. Please reach out to the Udemy Business support team if you have any questions.

Udemy Business supports federated authentication via SAML 2.0-based Single Sign-On (SSO). When SSO is enabled, Enterprise Plan customers will be able to manage employee authorization and authentication to their Udemy Business learning site from their corporate identity system. 

This article will cover all the key steps to add and configure Udemy Business SSO for OneLogin. You may, however, also want to refer to this OneLogin article regarding configuring apps for additional details.

Learn how to configure advanced SSO settings on an organizational level.

Features

Learn more about the provisioning features that are supported through single sign-in (SSO) with Udemy Business.

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive.  Please copy paste directly from the list below to ensure proper formatting:

Required 

Attributes

email 

firstName 

middleName 

lastName 

displayName 

Name ID

groups 

externalID

lmsUserID 

licenseTypes 

licensePoolName

Steps to Configure Udemy Business and Onelogin:

1. Add Udemy Business app from the OneLogin app catalog
2. Download SAML metadata (to upload into your Udemy Business account)
3. Upload OneLogin SAML metadata to Udemy Business account
4. Assign users to the Udemy Business application in OneLogin

Step 1: Add Udemy Business app from the OneLogin app catalog

Start by navigating to Applications > Add App in the OneLogin administrator dashboard. Next, search for “Udemy Business” in the App Catalog.

Select Add App:

Search for and click Udemy Business:

Click on Save to add the application:

Navigate to the Configuration tab and enter in your Udemy Business subdomain and then save. For example, if your company name is Acme Co. and your Udemy Business domain is https://acmeco.udemy.com, you would enter acmeco into the text field:

Step 2: Download SAML metadata (to input into your Udemy Business account)

Still in the Udemy Business Application tab from the previous step, navigate to the More Actions button:

And click the SAML Metadata button to download the SAML Metadata file. Save the file for the next step:

Step 3: Upload OneLogin SAML metadata to Udemy Business account (Note: For this step you will need Udemy Business Admin access)

In your Udemy Business account, navigate to Manage > Settings > Single Sign-On (SSO):

Select the Single Sign-On tab from the left hand menu.

Click the Start setup drop down and select OneLogin:

Add a Connection Name, select the OneLogin Metadata file from the last step, and click Save:

Step 4: Assign users to the Udemy Business application in OneLogin

Back in your OneLogin account, in the Access tab and Users tab, configure the users’ access for the newly created app, either by adding Udemy Business app to a role (recommended), or adding the app to a specific user. Please see OneLogin's article regarding how to assign users to applications. 

You have now completed configuring SSO for Udemy Business with OneLogin.

Users or roles which have been added to the Udemy Business account should now successfully be able to login and authenticate via OneLogin SSO!

Additional information about OneLogin is available in the OneLogin Knowledge Base.

SSO is set up so you can also configure SCIM provisioning in OneLogin with Udemy Business. This will allow you to provision, deprovision, create groups, manage group membership and change user profile details like name and email address in OneLogin. Any changes made within OneLogin will automatically update Udemy Business and other applications you have set up via this mechanism so you can manage your users in one place.  

You do not need to update both OneLogin and Udemy Business separately with these actions as it will all be synced from OneLogin. Learn more about configuring SCIM provisioning with OneLogin.

In this tutorial, we will configure ADFS with Udemy Business using the metadata from ADFS.

• Access the Udemy Business SAML Metadata for ADFS.
• Learn how to configure advanced SSO settings on an organizational level.
• Cohort learning: Review how to configure SSO for our cohort learning platform, Corp U.
• Note: SSO integration is only available with the Enterprise Plan.

Note:  

• Note: On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we're currently working to transition all existing connections from the legacy experience. You can read about the now standard experience here. Please reach out to the Udemy Business support team if you have any questions.

Features

Learn more about the provisioning features that are supported through single sign-in (SSO) with Udemy Business.

Configuring ADFS

1. Launch the ADFS 2.0 console. 

2. Under Trust Relationships > Relying Party Trusts, add a new Relying Party Trust. This will launch the wizard shown below.

3. Next, you will be prompted to import the Udemy Business Metadata file. Udemy Business SAML Metadata for ADFS is linked here.

4. Enter a name for the connection, for example Udemy Business. 

5. On the Choose Issuance Authorization Rules step, select Permit all users to access this relying party.

6. Click Next to view the summary and complete the wizard.

 7. Leave the “Open the Edit Claim Rules…” option checked and finish the wizard.

8. This will launch the Edit Claim Rules configuration utility.

9. This example will only gather claims from Active Directory to present to Udemy Business. 

10. Configure a basic claim set.

Udemy Business supports the following SAML attributes (all attributes are space and case sensitive).

Attributes

email 

firstName 

middleName 

lastName 

displayName 

Name ID

groups 

externalID

lmsUserID 

licenseTypes 

licensePoolName

11. Once you’ve configured the claims, back on the ADFS 2.0 Relying Party Trusts window, right-click the newly created connection and view the properties for the connection. Navigate to the Encryption tab and Remove the encryption certificate.

12. That will complete the ADFS configuration. Next, you should download the metadata and input it into your Udemy Business account to create the SSO connection.

You can find the Metadata file by inputting your server name and linking to the below:

https://<ADFS server name>/FederationMetadata/2007-06/FederationMetadata.xml 
 

Access the Single Sign-On (SSO) tab of your Udemy Business account. Click Start setup and choose your Identity Provider. On the configuration page, choose the appropriate metadata configuration method and follow the instructions to create the SSO connection with your Identity Provider and Udemy Business.

In this tutorial, we will configure Google Workspace (formerly known as G Suite and Google Apps for Work). 

• Access Udemy Business SAML Metadata for Google Workspace.
• Learn how to configure advanced SSO settings on an organizational level.
• Cohort learning: Review how to configure SSO for our cohort learning platform, Corp U.
• Note: SSO integration is only available with the Enterprise Plan.

Note: 

• On March 25, 2026, we introduced a new, streamlined way to configure SSO. This new experience became the standard setup experience for all net-new configurations after that date, and we're currently working to transition all existing connections from the legacy experience. You can read about the now standard experience here. Please reach out to the Udemy Business support team if you have any questions.

Features

Learn more about the provisioning features that are supported through single sign-in (SSO) with Udemy Business.

Locating Your SaasID

To configure Google Workspace you will need your SaasID. This value will be provided by Udemy Business and it is going to be the sub domain to access udemy, e.g. the yoursubdomain where the Udemy Business full address is yoursubdomain.udemy.com.

In addition to your SaasID, you will also need the following parameters to configure Google Workspace.

• ACS URL 
  https://sso.connect.pingidentity.com/sso/sp/ACS.saml2?saasid=yoursubdomain
• EntityID
  PingConnect
• Start URL
  https://pingone.com/1.0/d905a6ca-adf9-45e2-9b9d-0d6485f27206

Please note:  If you are already using PingConnect as an Entity ID for another existing SSO application, please contact Udemy Business to create a unique Entity ID and generate a custom metadata file.

Creating a New SAML Application in Google Workspace

The steps below outline how to create a new SAML application in Google Workspace.

• Log into Google Workspace Admin Console.
• Navigate to Apps > Web and Mobile apps.

• Click Add app > Add custom SAML app.

• Enter the Application Name and Description, upload a logo if desired, and click Continue.
• Click on the Download Metadata under Option 1 and click Continue.
• Fill in the ACS URL, Entity ID, Start URL and Name ID with the property values below and click continue.
  • ACS URL
    https://sso.connect.pingidentity.com/sso/sp/ACS.saml2?saasid=yoursubdomain
    EntityID
    PingConnect
    Start URL
    https://pingone.com/1.0/d905a6ca-adf9-45e2-9b9d-0d6485f27206

• Leave Start URL blank if users will only be accessing Udemy Business directly from the account URL (i.e., yoursubdomain.udemy.com). If your users will be accessing Udemy Business from Google Workspace, then you will need to apply the following value for the Start URL: https://pingone.com/1.0/d905a6ca-adf9-45e2-9b9d-0d6485f27206
• Next, add the attributes exactly seen in the screenshot below.

• (Optional: Adding Users to Groups via SAML Assertion
  To assign users to groups through SAML assertions, include the “groups” attribute under the Group Membership section.
• Important:
  • Ensure the groups you wish to assign are already created in Udemy.
  • Use the “Search for a group” field to select and add the desired groups. Any groups not added in this section will not be passed to Udemy.
• Click Finish to complete the wizard.
• By default, new applications are OFF for all users. To turn this on, go back to Apps > Web and mobile apps and click User Access.

•  In Service status, change the toggle to ON for everyone and click Save.

• Finally, you will grab the metadata file created in Step 5 and enter it into your Udemy Business account to create the SSO connection. 
  In Udemy Business, access the Single Sign-On (SSO) tab. Click Start setup and choose Google Workspace.

• On the configuration page, select Metadata file and Select file. Then upload the file received from Step 5.

Please note: when adding a new SAML application in Google Workspace, it might take up to 24 hours for the process to be completed.

Once the SAML application is created, you will need to configure attributes that are going to be sent in the SAML assertion.

Udemy Business supports the following SAML attributes

Please note: all attributes are space and case-sensitive.  Please copy paste directly from the list below to ensure proper formatting:

email 

firstName 

middleName 

lastName 

displayName 

Name ID

groups 

externalID

lmsUserID 

licenseTypes 

licensePoolName

This article explains how Admins can replace the Security Assertion Markup Language (SAML 2.0)  Certificate for Single Sign-on (SSO) configured, Udemy Business accounts. 

How to update an SSO certificate in Udemy Business

You can replace your SAML Certificate in your Udemy Business account, by using our self-serve settings. You will need either: 

1. The SAML certificate file (.crt, .cert format)
2. The SAML Metadata file (.xml format.)

To update the SAML Certificate via the certificate file, please follow the steps below:

1. Access Manage > Settings > Single Sign-On (SSO). 
2. Use the Replace Certificate link to upload a new SAML Certificate, which is provided by your Identity Provider.
3. Replace the certificate in your Identity Provider once it’s been updated in Udemy Business. 

To update the SAML Certificate via the metadata file, please follow the steps below:

1. Access Manage > Settings > Single Sign-On (SSO). 
2. Click on Edit Connection and select Configure using Metadata file
3. Select your metadata file and click “Save”

Note: please update your SAML Certificate in Udemy Business first, before updating it in your Identity Provider. This will help ensure a certificate mismatch from occurring, which would prevent your team from being able to access your Udemy Business account.