Single Sign-On Only Role Configuration in NetSuite

The Single Sign-On Only role in NetSuite is designed specifically for users who will access the platform exclusively through OpenID Connect (OIDC) single sign-on (SSO). When you designate a role as Single Sign-On Only, users must authenticate through OIDC, which enhances security by ensuring that credentials are managed by an external application.

Setting Up a Single Sign-On Only Role

To configure a role as Single Sign-On Only, follow these steps:

1. Navigate to the role customization screen via Setup > Users/Roles > Manage Roles.
2. Select the desired role to customize.
3. Check the Single Sign-On Only box.

This setting enforces the use of OIDC SSO, preventing access through the NetSuite web interface or APIs without SSO authentication. Important: This role type is incompatible with NetSuite for Outlook and restricts access solely through the authorized application. This is particularly beneficial for organizations seeking tighter control over user credentials and authentication processes.

SAML vs. OIDC SSO

It's noteworthy that you do not need to check the Single Sign-On Only box if you intend to utilize SAML single sign-on, as it is single sign-on only by default.

Limitations

• Users assigned to a Single Sign-On Only role cannot access the NetSuite platform through the standard user interface or web services without the OIDC SSO.
• Integration with certain applications, like NetSuite for Outlook, is not supported with this role configuration.

Best Practices

• Ensure your OIDC provider is correctly set up and integrated with your NetSuite account before implementing Single Sign-On Only roles.
• Regularly review and update role assignments to align with your organization's security policies and access strategies.