Knowledge Base

Single Sign-On for Okta

Last Modified: Sep 29, 2026

TeamViewer Single Sign-On (SSO) connects TeamViewer with Okta, allowing users to authenticate through their organization’s identity provider. You can configure SSO by adding the pre-built TeamViewer application from the Okta Integration Network(OIN) or by creating a custom SAML 2.0 application in Okta. This article explains both configuration methods and how to verify your domain.

This article applies to all TeamViewer Tensor license holders.

Requirements

To configure TeamViewer SSO with Okta, you need:

A TeamViewer Tensor license
A TeamViewer client version 13.2.1080 or newer on devices that use SSO
A TeamViewer account with company administrator rights
Access to the TeamViewer web app or installed client
Access to the DNS management of the domain that you want to enable for SSO
An Okta environment

Earlier TeamViewer versions cannot redirect users to the identity provider during sign-in

How to configure Single Sign-On with Okta

Choose the configuration method that matches your Okta setup.

Use this method to add the pre-built TeamViewer application from the Okta Integration Network catalog. The application already contains the TeamViewer service provider configuration and SAML attribute statements.

Supported features

The TeamViewer application in the Okta Integration Network (OIN) supports the following SAML 2.0 features:

Service provider (SP)-initiated SSO: Users start the sign-in process from the TeamViewer client or the TeamViewer web app and are redirected to Okta for authentication.
Identity provider (IdP)-initiated SSO: Users can start the sign-in process directly from their Okta dashboard.
SHA-256 signing: SAML messages are signed with SHA-256.

For more information on the listed features, see the Okta glossary in the Okta Help Center.

Note: SAML SSO and SCIM provisioning are independent features. You can configure and use SAML SSO without SCIM provisioning. If you also want to automate user and group lifecycle management, configure SCIM provisioning separately. For more information, see the SCIM Configuration guide.

Configuration steps

TeamViewer SSO is configured on two sides:

In Okta, you add the TeamViewer OIN app and enter your TeamViewer Customer Identifier.
In the web client or the installed client, you add your domain, paste Okta's metadata URL, and generate the Customer Identifier.

Step 1: Add the TeamViewer app from the OIN catalog

In the Okta Admin Console, open Applications and Resources and select Applications.
Select Browse App Catalog.

Search for TeamViewer and select it from the results.
Select Add Integration.

On the General Settings tab, edit the Application if required.
Select Next.

The TeamViewer OIN app is pre-configured with the correct Service Provider values and attribute statements, so you do not need to enter them by hand. For reference, the values are:

Setting	Value
Single Sign-On URL (ACS URL)	https://sso.teamviewer.com/saml/acs
Audience URI (SP Entity ID)	https://sso.teamviewer.com/saml/metadata
Name ID format	EmailAddress

Note: You must set the application username format to Email later in the configuration.

Step 2: Copy the Okta metadata URL

Open the Sign-On Options tab.
Scroll to Metadata details.
Copy the Metadata URL.

Step 3: Add your domain and generate the Customer Identifier

Follow these steps.

Sign in to the web client or the installed client.
Open Admin settings.
Select Single Sign-On.
Select Add domain.

Enter the domain that you want to enable for SSO.
Leave Configuration set to Metadata URL (the default),
Paste the metadata URL you copied from Okta (Step 2).
TeamViewer downloads the metadata and fills in the sign-on URL, entity ID, and public key automatically. Configure the available Options as needed, and select Continue.

On Set up SSO access, select an Exclusion list or Inclusion list.
Add the required users or groups, and select Continue.

On the Custom Identifier screen, select Generate or enter your own string.
Copy the Customer Identifier and store it securely for the remaining configuration.
Select Continue.

Important: Do not change the Customer Identifier after configuration. Changing it breaks SSO. TeamViewer does not store this value.

Step 4: Verify domain ownership

SSO remains inactive until you verify domain ownership.

On the Domain verification screen, create a new TXT record for your domain using the Name/Host and Value/Data shown.

Sign in to your DNS provider (your domain registrar or DNS host; for example, GoDaddy, Cloudflare, Namecheap, or AWS Route 53) in a separate browser tab.
Add a new DNS record with:

Type: TXT
Name / Host: the value shown in TeamViewer (enter @ if your provider requires it for the root domain)
Value / TXT Data: the value shown in TeamViewer
TTL: leave the default (for example, 1 hour)

Save the record. The exact field labels vary by provider, but every provider has an equivalent DNS management page for adding a TXT record.

Click Start verification. The status changes to Verification in progress; click Finish.

Note: DNS propagation can take several hours. TeamViewer looks for the TXT record for 24 hours after you start verification. If the record is not found in that time, verification fails and you must restart it from the domain edit panel.

Step 5: Add the Customer Identifier attribute in Okta

Return to your custom SAML application in Okta.
Open the General tab.
Edit the SAML settings.
Select Next to open Attribute Statements.

Step 6: Assign users and test sign-in

Open the TeamViewer application in Okta.
Open Assignments.
Assign the users or groups that require access.
Ask an assigned user to sign in and verify the configuration.

SAML assertion attributes

TeamViewer reads the SAML NameID as the user's email address and uses it to look up the account. The OIN app sends the following attribute statements automatically (using the Customer Identifier you entered in Step 5):

Attribute	Value	Used for
NameID (EmailAddress format)	user.email	Identifies the user by email
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	user.email	User email
http://sso.teamviewer.com/saml/claims/customeridentifier	Customer Identifier	Links the assertion to your TeamViewer company

The NameID must contain a valid email address that matches the user’s TeamViewer account. Users on the SSO exclusion list continue to sign in with their TeamViewer password.

Use this method when you want to create and configure a custom SAML 2.0 application in Okta, rather than using the pre-built catalog application (OIN).

Step 1: Create the Okta SAML application

In the Okta Admin Console, open Applications and select Applications.
Select Create App Integration.

Select SAML 2.0.
Select Next.

Enter a name for the application.
Select Next.
On the SAML Settings page, enter the values in the following table.

Fields	Information to be entered
Single Sign On URL	https://sso.teamviewer.com/saml/acs (Note: Leave the box Use this for Recipient URL and Destination URL ticked.)
Audience URI (SP Entity ID)	https://sso.teamviewer.com/saml/metadata
Name ID Format:	EmailAddress
Application username	Email

Select Show Advanced Settings.
Set Assertion Encryption to Encrypted.

Upload the TeamViewer public key to Encryption Certificate in Base64 format.

Under Attribute Statements, add the following email attribute.

Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Name format: URI Reference

Value: user.email

Select Next.
Select I'm an Okta customer adding an internal app.
Select This is an internal app.
Select Finish.

How to get the TeamViewer public key

Run the following PowerShell command to download the TeamViewer SAML metadata, extract the public key, and save it as a certificate file:

"-----BEGIN PUBLIC KEY-----`n"+ `
((Select-Xml `
-Content ((Invoke-WebRequest `
https://sso.teamviewer.com/saml/metadata.xml).Content) `
-xpath "//*[local-name()='X509Certificate']").Node[0].'#text') + `
"`n-----END PUBLIC KEY-----" `
| Out-File -FilePath "sso.teamviewer.com -saml.cer" -Encoding ascii

The resulting file is named sso.teamviewer.com-saml.cer

To export the certificate in Base64-encoded X.509 format:

Open sso.teamviewer.com-saml.cer.
Open the Details tab.
Select Copy to File.
Select Next.
Select Base-64 encoded X.509.
Select Next.
Enter a file name.
Select Next, and then select Finish.

The resulting Base64 certificate should look like this:

Step 2: Copy the Okta metadata URL

Open your custom SAML application in Okta.
Open the Sign On tab.
Copy the Identity Provider metadata URL.

Step 3: Add your domain and generate the Customer Identifier

Follow these steps.

Sign in to the web client or the installed client.
Open Admin settings.
Select Single Sign-On.
Select Add domain.

Enter the domain that you want to enable for SSO.
Leave Configuration set to Metadata URL (the default),
Paste the metadata URL you copied from Okta (Step 2).
TeamViewer downloads the metadata and fills in the sign-on URL, entity ID, and public key automatically. Configure the available Options as needed, and select Continue.

On Set up SSO access, select an Exclusion list or Inclusion list.
Add the required users or groups, and select Continue.

On the Custom Identifier screen, select Generate or enter your own string.
Copy the Customer Identifier and store it securely for the remaining configuration.
Select Continue.

Important: Do not change the Customer Identifier after configuration. Changing it breaks SSO. TeamViewer does not store this value.

Step 4: Verify domain ownership

SSO remains inactive until you verify domain ownership.

On the Domain verification screen, create a new TXT record for your domain using the Name/Host and Value/Data shown.

Sign in to your DNS provider (your domain registrar or DNS host; for example, GoDaddy, Cloudflare, Namecheap, or AWS Route 53) in a separate browser tab.
Add a new DNS record with:

Type: TXT
Name / Host: the value shown in TeamViewer (enter @ if your provider requires it for the root domain)
Value / TXT Data: the value shown in TeamViewer
TTL: leave the default (for example, 1 hour)

Save the record. The exact field labels vary by provider, but every provider has an equivalent DNS management page for adding a TXT record.

Click Start verification. The status changes to Verification in progress; click Finish.

Step 5: Add the Customer Identifier attribute in Okta

Return to your custom SAML application in Okta.
Open the General tab.
Edit the SAML settings.
Select Next to open Attribute Statements.

Add the customer identifier attribute:

Name: http://sso.teamviewer.com/saml/claims/customeridentifier

Name format: Unspecified

Value:
The Customer Identifier you generated in TeamViewer

Select Next.
Select Finish.

8. Copy this Token and go back to your Okta app.

TeamViewer client configuration

TeamViewer uses an embedded browser for identity provider authentication by default. You can configure TeamViewer to use the operating system’s default browser instead.

Windows

Set the following registry value:

HKEY_CURRENT_USER\Software\TeamViewer\SsoUseEmbeddedBrowser = 0

macOS

Run the following command:

defaults write com.teamviewer.teamviewer.preferences SsoUseEmbeddedBrowser -int 0

Troubleshooting

The following troubleshooting information comes from the OIN source page. The custom SAML source page does not contain an equivalent troubleshooting section. This content needs technical review before it becomes a common section for both methods.

Issue	Suggested check
SSO is not activated	Confirm that TXT-record domain verification completed successfully
Invalid SAML response appears	Confirm that TeamViewer could retrieve and import the Okta metadata URL
A user is not recognized after Okta authentication	Confirm that the SAML NameID contains the email address associated with the user’s TeamViewer account
SSO stopped working	Confirm that the Customer Identifier has not changed
An assertion is expired	Confirm that the relevant system clocks are synchronized

The OIN source additionally suggests re-adding the domain to refresh metadata after an Okta signing-certificate rotation.

Contact support

If you need help with the configuration, contact TeamViewer Customer Support.

TeamViewer Remote

TeamViewer Tensor

TeamViewer DEX

TeamViewer Frontline

TeamViewer ONE Platform