How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace

MattW — Thu, 04 Jul 2024 06:37:07 GMT

Intro

One of the most critical strategies for user management in a modern organization is Single Sign On (SSO); the ability to use a single set of credentials to securely access many different applications and platforms. On-premise SSO solutions, such as Microsoft's Active Directory, can use LDAP (Lightweight Directory Access Protocol) to provide this type of access in your internal network, but what about cloud-based applications that are accessed over the public internet?

Remote, cloud-based applications can be integrated into an SSO solution using the concept of Federated Identity Management (FIM), which leverages SAML (Security Assertion Markup Language) to securely pass identity information between an Identity Provider (IdP) and a Service Provider (SP) that have been Federated (they trust each other).

While the actual functionality of SAML is beyond the scope of this article, we'll be focusing on the different types of Federation that Dynatrace offers for SSO, and specifically, how use our Account Management portal to successfully configure each one.

Federation Types

In early 2024, Dynatrace rolled out Flexible Identity Federation for SaaS, an expansion of our standard SAML configuration to provide more SSO options for customers with varied use cases and requirements.
https://www.dynatrace.com/news/blog/unlock-seamless-access-the-power-of-flexible-identity-federation...

When adding a SAML configuration for an SSO domain, one of three selectable federations will now determine when and how SSO should apply for users with that domain name when logging into Dynatrace.

Global - applies to ALL SSO domain users for ANY Dynatrace account (previously the only federation available)
Account-specific - applies to SSO domain users for ALL environments of a SINGLE account
Environment-specific - applies to SSO domain users for SELECTED environments within a SINGLE account

A more detailed breakdown of these Federation types can be found in our documentation here:

https://docs.dynatrace.com/docs/manage/access-control/user-management-and-sso/manage-users-and-group...

How to Add a SAML configuration in Dynatrace

In this article, we'll be walking you through how to add a SAML configuration for each of the following:

Global Federation
Account Federation
Environment Federation

Global Federation

Unlike Account federation, Global federation requires that a domain first be verified before a SAML configuration can be added

To get started click Identity & access management and then Domain verification

Enter the domain you want to use for SSO and click Add

In the next screen, you'll be provided with the value of a TXT record you'll need to add to the DNS record of the domain you're attempting to verify. Click (1) Copy value and add the site verification string as the data in the TXT record for the domain and then once you have confirmed this record has propagated, click the 3 dots followed by (2) Verify.

Once successful, you will see your domain listed under Verified domains

This domain can now be used for our Global federation.

To get started, click Identity & access management followed by SAML configuration

Click the New configuration button

Select Global federation as federation type

In the next screen, select the domain that you verified and then click Download XML to get the SP metadata which will be used to configure SSO at your specific IdP

Once this has been done, obtain the resulting IdP metadata from your IdP, return to the SAML configuration page in Dynatrace, and add the metadata either by uploading an XML with Choose file or copying and pasting the metadata contents into the Identity provider SAML metadata textbox

Scroll down to the Attribute mapping section and add the Firstname, Lastname, and Federated attributes based on the settings of your specific IdP

Click Next to validate your SAML configuration. This will attempt to use the settings you have entered by sending a login request to your IdP based off of the user you are currently logged into Dynatrace with. Depending on your IdP, you may notice that you are redirected to your SSO login page, in which case you will want to enter your credentials as you normally would.

Once the request has finished, you will receive a SAML configuration validation complete message and you can close your current browser tab to view the results of the validation

If successful, the results should contain the login username, first name, last name, and group(s) that your current user belongs to

Once the SAML configuration has been validated and you are ready to start using SSO, ensure that Enable SSO is switched on and click the Complete configuration button to save your SAML configuration

If you are not yet ready to fully implement SSO or have not yet created your fallback account, DO NOT enable SSO. You will still be able to save the configuration and can enable it at any time by editing the SAML configuration.

Account Federation

To start, log into https://myaccount.dynatrace.com and click Identity & access management followed by SAML configuration

Click the New configuration button

Select Account federation as federation type

In the next screen, provide a name for your configuration and click the Generate SP metadata button

Note that the button changes to Download SP metadata

Click this button again to get an XML file of the SP metadata which will be used to configure SSO at your specific IdP

Scroll down to the Attribute mapping section and add the Firstname, Lastname, and Federated attributes based on the settings of your specific IdP

If successful, the results should contain the login username, first name, last name, and group(s) that your current user belongs to

The results may also contain warnings, which you can choose to ignore and move on, or errors, which will prevent the configuration from being saved and need to be fixed.
Note: If you are unsure of how to proceed with your validation results, please contact Support with a screenshot of them, if possible.

However, as long as everything looks correct, you can click next and proceed to the Scope assignment section

Account federation allows you to select one of two different domain scopes, which will further determine how SSO will function

Option A allows you to select one or more verified domains. This will allow you to set up a standard SSO integration for the selected domain that will be limited to only your Dynatrace account. This is useful in the case of large organizations that share the same domain name but have separate SSO implementations and Dynatrace accounts. Previously, this functionality was referred to as "non-global federation".
Option B allows you to authenticate users with domains that have not been verified in Dynatrace, but exist as users in your IdP. In other words, users belonging to partner organizations or other domains you do not have direct control over that are still part of your SSO and need to access Dynatrace.

Once the scope selection has been made and you are ready to start using SSO, ensure that Enable SSO is switched on and click the Complete configuration button to save your SAML configuration

Environment Federation

To start, log into https://myaccount.dynatrace.com and click Identity & access management followed by SAML configuration

Click the New configuration button

Select Environment federation as federation type

In the next screen, provide a name for your configuration and click the Generate SP metadata button

Note that the button changes to Download SP metadata

Click this button again to get an XML file of the SP metadata which will be used to configure SSO at your specific IdP

Scroll down to the Attribute mapping section and add the Firstname, Lastname, and Federated attributes based on the settings of your specific IdP

If successful, the results should contain the login username, first name, last name, and group(s) that your current user belongs to

What federation is referring to here is which environment(s) you will choose SSO to apply to. For example, you may have one production environment and one development environment that each use separate IdPs.
This would allow you to ensure that when a user logs into their environment that they are also routed to their respective IdP.

Each Environment federation that you add requires that you select two options

A - The UUID of the environment you want this federation to apply to
B - The associated verified domain(s) this federation should apply to

As an example, it should look something similar to this:

Once all desired federations have been added and you are ready to start using SSO, ensure that Enable SSO is switched on and click the Complete configuration button to save your SAML configuration

Troubleshooting scenarios

Re: How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace

The_AM — Sun, 02 Feb 2025 23:10:58 GMT

Appreciate the screenshots and step-by-step guide. Easier to understand, since all the newly updated docs don't include any visuals any more.

Re: How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace

AndrasKovacs — Thu, 25 Sep 2025 15:06:58 GMT

Great guide, thank you.

My tip in terms of SAML group attributes: although the doc says:

that in the SAML message returned by Azure, groups are identified with an ObjectId, not a group name. When configuring the user group mapping, make sure you use ObjectId in SAML Group Attribute Value field.

--> it makes sense to check your SAML answer, if it supports group name attribute like this: http://schemas.microsoft.com/ws/2008/06/identity/claims/role

because working with group names is easier than with group IDs.

Re: How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace

The_AM — Sun, 12 Oct 2025 22:45:43 GMT

@AndrasKovacs whilst your tip is good, I would say there's two reasons why ObjectId is suggested in the doc:

1. It's typically the default with Azure Entra Id, and this is often overlooked as the cause for mismatched claims (causing headaches for admins/support)

2. Azure/SAML might not enforce unique names, but Dynatrace does (at least for group names in Dynatrace, there cannot be duplicates and it should be the same for attaching claims)

A message like below would occur if you try to create a duplicated group name in Dynatrace:

Failed to create group! .... Cannot process the request. Duplicate entry.

article How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace in Troubleshooting

How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace

Intro

Federation Types

How to Add a SAML configuration in Dynatrace

Account Federation

Re: How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace

Re: How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace

Re: How to use SAML Federation to set up Single Sign On (SSO) in Dynatrace