Knowledge Base

Single Sign-On for Okta

Last Modified 20 lip 2026

TeamViewer Single Sign-On (SSO) connects TeamViewer with Okta, allowing users to authenticate through their organization’s identity provider. You can configure SSO by adding the pre-built TeamViewer application from the Okta Integration Network(OIN) or by creating a custom SAML 2.0 application in Okta. This article explains both configuration methods and how to verify your domain.

This article applies to all TeamViewer Tensor license holders.

Requirements

To configure TeamViewer SSO with Okta, you need:

A TeamViewer Tensor license
A TeamViewer client version 13.2.1080 or newer on devices that use SSO
A TeamViewer account with company administrator rights
Access to the TeamViewer web app or installed client
Access to the DNS management of the domain that you want to enable for SSO
An Okta environment

Earlier TeamViewer versions cannot redirect users to the identity provider during sign-in

How to configure Single Sign-On with Okta

Choose the configuration method that matches your Okta setup.

Step 1: Create the Okta SAML application

In the Okta Admin Console, open Applications and select Applications.
Select Create App Integration.

Select SAML 2.0.
Select Next.

Enter a name for the application.
Select Next.
On the SAML Settings page, enter the values in the following table.

Fields	Information to be entered
Single Sign On URL	https://sso.teamviewer.com/saml/acs (Note: Leave the box Use this for Recipient URL and Destination URL ticked.)
Audience URI (SP Entity ID)	https://sso.teamviewer.com/saml/metadata
Name ID Format:	EmailAddress
Application username	Email

Select Show Advanced Settings.
Set Assertion Encryption to Encrypted.

Upload the TeamViewer public key to Encryption Certificate in Base64 format.

Under Attribute Statements, add the following email attribute.

Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Name format: URI Reference

Value: user.email

Select Next.
Select I'm an Okta customer adding an internal app.
Select This is an internal app.
Select Finish.

How to get the TeamViewer public key

Run the following PowerShell command to download the TeamViewer SAML metadata, extract the public key, and save it as a certificate file:

"-----BEGIN PUBLIC KEY-----`n"+ `
((Select-Xml `
-Content ((Invoke-WebRequest `
https://sso.teamviewer.com/saml/metadata.xml).Content) `
-xpath "//*[local-name()='X509Certificate']").Node[0].'#text') + `
"`n-----END PUBLIC KEY-----" `
| Out-File -FilePath "sso.teamviewer.com -saml.cer" -Encoding ascii

The resulting file is named sso.teamviewer.com-saml.cer

To export the certificate in Base64-encoded X.509 format:

Open sso.teamviewer.com-saml.cer.
Open the Details tab.
Select Copy to File.
Select Next.
Select Base-64 encoded X.509.
Select Next.
Enter a file name.
Select Next, and then select Finish.

The resulting Base64 certificate should look like this:

Step 2: Copy the Okta metadata URL

Open your custom SAML application in Okta.
Open the Sign On tab.
Copy the Identity Provider metadata URL.

Step 5: Add the Customer Identifier attribute in Okta

Return to your custom SAML application in Okta.
Open the General tab.
Edit the SAML settings.
Select Next to open Attribute Statements.

Add the customer identifier attribute:

Name: http://sso.teamviewer.com/saml/claims/customeridentifier

Name format: Unspecified

Value:
The Customer Identifier you generated in TeamViewer

Select Next.
Select Finish.

8. Copy this Token and go back to your Okta app.

TeamViewer client configuration

TeamViewer uses an embedded browser for identity provider authentication by default. You can configure TeamViewer to use the operating system’s default browser instead.

Windows

Set the following registry value:

HKEY_CURRENT_USER\Software\TeamViewer\SsoUseEmbeddedBrowser = 0

macOS

Run the following command:

defaults write com.teamviewer.teamviewer.preferences SsoUseEmbeddedBrowser -int 0

Troubleshooting

The following troubleshooting information comes from the OIN source page. The custom SAML source page does not contain an equivalent troubleshooting section. This content needs technical review before it becomes a common section for both methods.

The OIN source additionally suggests re-adding the domain to refresh metadata after an Okta signing-certificate rotation.

Contact support

If you need help with the configuration, contact TeamViewer Customer Support.

TeamViewer Remote

TeamViewer Tensor

TeamViewer DEX

TeamViewer Frontline

Platforma TeamViewer ONE