--- sourceDocument: Australia Sales Customer Relationship Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/order-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Sales Customer Relationship Management ft:clusterId : - omgmt bundleId : - omgmt workflow : - Customer and Industry --- # Single sign-on (SSO) integration # Single sign-on (SSO) integration {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Single sign-on (SSO) integration This guide explains how to integrate Single Sign-On (SSO) with ServiceNow Configure, Price, Quote (CPQ) for headless use cases such as embedding CPQ on websites or eCommerce platforms. It outlines the process to set up SSO with various identity providers (IdPs) that support OAuth2 with OpenID Connect (OIDC), emphasizing that ServiceNow CPQ does not support SAML. Customers need to submit an SSO Setup Request Form with their IdP details to initiate the provisioning process by the ServiceNow CPQ team. Show full answer Show less ## Key Steps for Integration * Create an application for ServiceNow CPQ in your chosen IdP. * Share the app parameters and user details with the ServiceNow CPQ team. * Coordinate with the CPQ team to finalize provisioning, including a brief call to exchange sensitive information like client secrets. * Test the redirect flow to ensure successful SSO login to your tenant-specific ServiceNow CPQ URL. Note that prior users may need to be re-added after SSO implementation, and these steps are unnecessary if using ServiceNow CPQ with Salesforce. ## Configuring Specific Identity Providers ### Google SSO ServiceNow CPQ supports Google for both personal and business SSO. The only requirement is to provide the names and email addresses of users. Email accuracy is critical as emails are case sensitive during authentication. ### Okta SSO * Follow Okta Developer instructions to create an app supporting Authorization Code Flow. * Set the redirect URL as: `https://[your-tenant].test.cpq/login/oauth2/code/[your-okta-subdomain]`. * Collect client ID, client secret, redirect URL, and Okta domain, verifying the OpenID metadata endpoint. * Provide these details and user information to ServiceNow CPQ for provisioning. * Test the redirect flow which should lead to an Okta consent screen. ### Microsoft Entra ID SSO * Register an app in Microsoft Entra following Microsoft documentation. * Set redirect URI as: `https://[your-tenant].test.cpq/login/oauth2/code/[your-subdomain]-entra` under Web platform. * Enable ID tokens on the Authentication tab. * Note client ID, client secret (record securely as it won't be shown again), and Authority URL with `/v2.0` suffix. * Optionally add users or app roles for testing via Microsoft Entra portal. * Submit client ID, Authority URL, redirect URI, and user info to ServiceNow CPQ. * Validate setup by accessing your tenant CPQ URL leading to an Entra ID consent screen. ## Troubleshooting * **Issuer mismatch:** Ensure the issuer URL includes `/v2.0` after tenant ID and set `accessTokenAcceptedVersion` to 2 in the app manifest. * **Incorrect redirect for admin:** Set `acceptMappedClaims` to true in the manifest. ## Additional Notes ServiceNow CPQ now supports SSO with any OAuth2 with OIDC-compliant IdP. When using a different IdP, provide detailed information via the SSO Setup Request Form to initiate integration assistance from the ServiceNow CPQ team. If you intend to use ServiceNow CPQ for a headless use case (such as exposing ServiceNow CPQ on a website or eCommerce platform), please fill out and submit an SSO Setup Request Form that details the identity provider (IdP) you are using for single sign-on (SSO). This process involves: * Creating an app for ServiceNow CPQ in your IdP tool of choice. See the steps and links below. * Sharing parameters and users from the app with the ServiceNow CPQ team. The team will complete the provisioning process using the parameters that you send. * Testing and confirming that the SSO redirect works as expected. {#cpq-single-sign-on-sso-integration__ul_xvm_lyx_23c} Note the following considerations: * ServiceNow CPQ can now support SSO with any IdP that supports OAuth2 with OpenID Connect (OIDC). * ServiceNow CPQ is not compatible with SAML. * Your IdP client must be up to date. * Users who have been added to ServiceNow CPQ before SSO was implemented may need to be added again. * These steps are not required if you are using ServiceNow CPQ with Salesforce. {#cpq-single-sign-on-sso-integration__ul_fvl_qyx_23c} ## Configuring Google SSO {#cpq-single-sign-on-sso-integration__section_zvc_xyx_23c} ServiceNow CPQ supports Google for both personal and business single sign-on. If you use Google IdP for identity verification, all we need are the names and email addresses of your users. ## Configuring Okta SSO {#cpq-single-sign-on-sso-integration__section_vbw_yyx_23c} To set up an application that supports the Authorization code flow for ServiceNow CPQ, start by following the Okta Developer instructions: [Implement authorization by grant type: set up your app](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/#set-up-your-app) For the redirect URL, specify your ServiceNow CPQ URL, append `/login/oauth2/code/`, and then append your `-okta` subdomain. So if your URL is `example.test.cpq`, your redirect URL would be `https://example.test.cpq/login/oauth2/code/example-okta`. Note your client ID, client secret, redirect URL, and Okta domain. Note: To confirm that your Okta domain is accurate, you can confirm that the OpenID connection metadata is visible by visiting `https://{oktaDomain}/.well-known/openid-configuration`. You should see a JSON file with information about the authorization server endpoints. Provide these values together with any user details, such as name and email, for users that you want to test with. The ServiceNow CPQ team will schedule a brief call with you to obtain your client secret. The team will complete the provisioning process from there. Note: Users' email addresses will be used for authentication. These are case sensitive, so make sure that the email addresses you provide are accurate. When your ServiceNow CPQ point of contact has confirmed that setup is complete, try to visit your tenant-specific ServiceNow CPQ URL. You should see a redirect flow that brings you to an Okta consent screen to allow access to your ServiceNow CPQ app. ## Configuring Entra ID SSO {#cpq-single-sign-on-sso-integration__section_r15_xyx_23c} Register an app by following the instructions on the following Microsoft Entra documentation website: [Register an application in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) In the Redirect URI section of the Microsoft Entra registration page, in the Select a platform menu, select Web. For the redirect URI, enter your tenant-specific URL, append `/login/oauth2/code/`, and then append `-entra`. For example, if your URL is `example.test.cpq`, your redirect URI is `https://example.test.cpq/login/oauth2/code/example-entra`. Make sure to select ID tokens on the Authentication tab of your app. For more information about OIDC, see the following Microsoft Entra documentation website: [OpenID Connect on the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc). Note your client ID, client secret, and your Authority URL. Note: Make sure you note the client secret at this time. It won't be available to you later. For information about how to validate your Authority URL, see "Find your app's OpenID configuration document URI" at the Microsoft Entra documentation website: [OpenID Connect on the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc). To get the correct issuer in the metadata, make sure to include `/v2.0` at the end. You should be able to see the metadata and validate your issuer URL by visiting it in a browser with `/.well-known/openid-configuration` appended to it. For example: `https://login.microsoftonline.com/c7dd9346-1cfc-4bd8-a34c-a066c8bc0477/v2.0/.well-known/openid-configuration`. Note: It may be possible to directly associate your users with the application via the ManagerUsers and groupsAdd user/group option in your application. Optionally, add an app role for the users whom you wish to test with. For more information, see "Add a user account to your directory, and add that account to an appRole" on the following Microsoft Entra documentation website: [Add sign-in with Microsoft Entra account to a Spring web app](https://learn.microsoft.com/en-us/azure/developer/java/spring-framework/configure-spring-boot-starter-java-app-with-entra?toc=/entra/identity-platform/toc.json&bc=/entra/identity-platform/breadcrumb/toc.json#create-microsoft-entra-instance) On the SSO Setup Request Form, provide the client ID, Authority URL, and redirect URl together with user details (email, name) for the users you wish to test with. The ServiceNow CPQ team will schedule a brief call with you to obtain your client secret. By default, each user's emails will act as their identifiers, but it may be possible to use a different identifier in a user profile. The fields that can be used as identifiers are limited by what's available at the `user_info` endpoint defined in the well-known/openid-configuration URL described above. For more information about the `user_info` endpoint, see the following Microsoft Entra documentation website: [Microsoft identity platform UserInfo endpoint](https://learn.microsoft.com/en-us/entra/identity-platform/userinfo). Once your ServiceNow CPQ point of contact has confirmed that setup is complete, try to visit your tenant-specific ServiceNow CPQ URL. You should see a redirect flow that brings you to an Entra ID consent screen to allow access to your ServiceNow CPQ app. {#cpq-single-sign-on-sso-integration__table_rhp_c2y_23c__entry__2} | Issue | Resolution | |-|-| | The issuer does not match the expected value. For example, the issue is `sts.microsoft.net` instead of `login.microsoftonline.com`. | * Make sure that your issuer URL includes `/v2.0` after the tenant ID. * Update the application manifest to set the accessTokenAcceptedVersion to 2. {#cpq-single-sign-on-sso-integration__ul_zc1_g2y_23c} | | Admin is redirected to http://cpq.ai, despite being set up correctly. | In your manifest, set the acceptMappedClaims parameter to true in your manifest. | [Table 1. Troubleshooting] {#cpq-single-sign-on-sso-integration__table_rhp_c2y_23c} ## Configuring another IdP {#cpq-single-sign-on-sso-integration__section_pp1_1zx_23c} ServiceNow CPQ can now support SSO with any IdP that supports OAuth2 with OpenID Connect (OIDC). In the SSO Setup Request Form, provide details about your preferred IdP tool and our team will connect with you to ensure it is properly integrated with ServiceNow CPQ. *[\>]: and then