{"id":2056322,"date":"2025-08-18T00:00:11","date_gmt":"2025-08-18T07:00:11","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=2056322"},"modified":"2025-09-05T11:04:22","modified_gmt":"2025-09-05T18:04:22","slug":"action-required-arcgis-online-saml-customers","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/action-required-arcgis-online-saml-customers","title":{"rendered":"Action Required: ArcGIS Online & Location Platform SAML Customers"},"author":167172,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501,738191],"tags":[24081,24071,241722],"industry":[],"product":[36551,763582],"class_list":["post-2056322","blog","type-blog","status-publish","format-standard","hentry","category-administration","category-developers","tag-ssamymlgp","tag-security","tag-ssamlymlgp","product-arcgis-online","product-trust-arcgis"],"acf":{"authors":[{"ID":167172,"user_firstname":"Gregory","user_lastname":"Ponto","nickname":"Gregory Ponto","user_nicename":"gponto","display_name":"Gregory Ponto","user_email":"GPonto@esri.com","user_url":"","user_registered":"2021-01-28 20:29:23","user_description":"","user_avatar":""}],"short_description":"Customers that have configured the SAML options \"Enabled Signed Requests\" or \"Encrypt Assertion\" must update their ArcGIS Online metadata file.","flexible_content":[{"acf_fc_layout":"content","content":"

ArcGIS Online (and Location Platform) Organization administrators that have enabled Signed and\/or Encrypted SAML Assertions<\/strong> in alignment with ArcGIS Online Best Practices for SAML Security<\/a> must obtain the latest ArcGIS Online Service Provider metadata file + certificate<\/a> and associate it with their Enterprise (SAML) Identity Provider (e.g. Entra ID Enterprise Applications<\/a>) before September 19, 2025 <\/strong>to ensure continued (SAML) login operations with ArcGIS Online.<\/p>\n

\n

Administrators who have enabled<\/strong> the Best Practices for SAML Security<\/a> feature: “Enable signed request<\/strong>” must complete Steps 1-2<\/strong> below:<\/h4>\n"},{"acf_fc_layout":"content","content":"

Step 1 – Download the updated metadata file from ArcGIS Online:<\/h3>\n
    \n
  1. Login to www.arcgis.com<\/a> (or location.arcgis.com<\/a> for Location Platform) with your administrative credentials,<\/li>\n
  2. Click on “Organization” then “Settings” then “Security”,<\/li>\n
  3. Scroll down to “Logins” > “SAML login”, then click the “Download service provider metadata” link (as shown below.) This action will download the metadata file (which contains the updated certificate) which will be uploaded to your SAML Identity Provider.<\/li>\n<\/ol>\n

     <\/p>\n"},{"acf_fc_layout":"image","image":{"ID":2056602,"id":2056602,"title":"Download SAML SP Metadata","filename":"2023-08-18_10-50-13.png","filesize":43317,"url":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13.png","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/action-required-arcgis-online-saml-customers\/2023-08-18_10-50-13","alt":"","author":"167172","description":"","caption":"","name":"2023-08-18_10-50-13","status":"inherit","uploaded_to":2056322,"date":"2023-08-18 18:43:22","modified":"2023-08-18 18:59:08","menu_order":0,"mime_type":"image\/png","type":"image","subtype":"png","icon":"https:\/\/www.esri.com\/arcgis-blog\/wp-includes\/images\/media\/default.png","width":1199,"height":160,"sizes":{"thumbnail":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13-213x160.png","thumbnail-width":213,"thumbnail-height":160,"medium":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13.png","medium-width":464,"medium-height":62,"medium_large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13.png","medium_large-width":768,"medium_large-height":102,"large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13.png","large-width":1199,"large-height":160,"1536x1536":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13.png","1536x1536-width":1199,"1536x1536-height":160,"2048x2048":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13.png","2048x2048-width":1199,"2048x2048-height":160,"card_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13-826x110.png","card_image-width":826,"card_image-height":110,"wide_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_10-50-13.png","wide_image-width":1199,"wide_image-height":160}},"image_position":"center","orientation":"horizontal","hyperlink":""},{"acf_fc_layout":"content","content":"

    Step 2 – Upload the metadata file into your Enterprise Identity (SAML) Provider:<\/h3>\n
      \n
    1. Within your Enterprise (SAML) Identity Provider > Application configuration, locate the App entry for your ArcGIS Online Organization.<\/li>\n
    2. Upload the updated metadata file downloaded from ArcGIS Online to your SAML Identity Provider. See ArcGIS Online\u2019s Enterprise (SAML) Identity Provider<\/a>\u00a0guidance for IDP specific instructions on how to register the service provider metadata XML with your IDP.<\/li>\n<\/ol>\n

       <\/p>\n"},{"acf_fc_layout":"image","image":{"ID":2056632,"id":2056632,"title":"Upload SAML SP Metadata","filename":"2023-08-18_12-24-41.png","filesize":43999,"url":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41.png","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/action-required-arcgis-online-saml-customers\/2023-08-18_12-24-41","alt":"","author":"167172","description":"","caption":"","name":"2023-08-18_12-24-41","status":"inherit","uploaded_to":2056322,"date":"2023-08-18 18:44:21","modified":"2023-08-18 19:21:26","menu_order":0,"mime_type":"image\/png","type":"image","subtype":"png","icon":"https:\/\/www.esri.com\/arcgis-blog\/wp-includes\/images\/media\/default.png","width":1136,"height":307,"sizes":{"thumbnail":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41-213x200.png","thumbnail-width":213,"thumbnail-height":200,"medium":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41.png","medium-width":464,"medium-height":125,"medium_large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41.png","medium_large-width":768,"medium_large-height":208,"large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41.png","large-width":1136,"large-height":307,"1536x1536":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41.png","1536x1536-width":1136,"1536x1536-height":307,"2048x2048":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41.png","2048x2048-width":1136,"2048x2048-height":307,"card_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41-826x223.png","card_image-width":826,"card_image-height":223,"wide_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-24-41.png","wide_image-width":1136,"wide_image-height":307}},"image_position":"center","orientation":"horizontal","hyperlink":""},{"acf_fc_layout":"content","content":"

      This completes the SAML Certificate Rotation requirements for most organizations.<\/h3>\n

       <\/p>\n

      \n

      Administrators who have enabled<\/strong> the Best Practices for SAML Security<\/a> feature: “Allow Encrypt Assertion”<\/strong> must also complete Steps 3-4<\/strong> below:<\/h4>\n"},{"acf_fc_layout":"content","content":"

      Step 3 – Extract the certificate from the ArcGIS Online metadata file:<\/h3>\n
        \n
      1. Extract and validate the certificate within the metadata.xml file by copying the characters between the <X509Certificate> and <\/X509Certificate> tags, pasting the data to an empty file and saving it with a .cer extension.<\/li>\n<\/ol>\n

         <\/p>\n"},{"acf_fc_layout":"image","image":{"ID":2932121,"id":2932121,"title":"from_metadata","filename":"from_metadata.png","filesize":195539,"url":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata.png","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/action-required-arcgis-online-saml-customers\/from_metadata","alt":"","author":"167172","description":"","caption":"","name":"from_metadata","status":"inherit","uploaded_to":2056322,"date":"2025-08-18 14:44:46","modified":"2025-08-18 14:44:46","menu_order":0,"mime_type":"image\/png","type":"image","subtype":"png","icon":"https:\/\/www.esri.com\/arcgis-blog\/wp-includes\/images\/media\/default.png","width":1207,"height":733,"sizes":{"thumbnail":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata-213x200.png","thumbnail-width":213,"thumbnail-height":200,"medium":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata.png","medium-width":430,"medium-height":261,"medium_large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata.png","medium_large-width":768,"medium_large-height":466,"large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata.png","large-width":1207,"large-height":733,"1536x1536":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata.png","1536x1536-width":1207,"1536x1536-height":733,"2048x2048":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata.png","2048x2048-width":1207,"2048x2048-height":733,"card_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata-766x465.png","card_image-width":766,"card_image-height":465,"wide_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2024\/08\/from_metadata.png","wide_image-width":1207,"wide_image-height":733}},"image_position":"center","orientation":"horizontal","hyperlink":""},{"acf_fc_layout":"content","content":"

        Step 4 – Update the Token Encryption certificate within the Enterprise (SAML) Identity Provider:<\/h3>\n
          \n
        1. Within your Enterprise (SAML) Identity Provider > Application configuration, locate the entry for your ArcGIS Online.<\/li>\n
        2. Upload (and activate) the extracted certificate to the “Encryption” feature of the Enterprise (SAML) Identity Provider > ArcGIS Online App entry.\u00a0 Refer to your Enterprise Identity Provider’s documentation for specific instructions on this workflow.<\/li>\n<\/ol>\n

           <\/p>\n"},{"acf_fc_layout":"image","image":{"ID":2056642,"id":2056642,"title":"SAML Token Encryption","filename":"2023-08-18_12-28-09.png","filesize":36251,"url":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09.png","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/action-required-arcgis-online-saml-customers\/2023-08-18_12-28-09","alt":"","author":"167172","description":"","caption":"","name":"2023-08-18_12-28-09","status":"inherit","uploaded_to":2056322,"date":"2023-08-18 18:44:38","modified":"2023-08-18 20:24:21","menu_order":0,"mime_type":"image\/png","type":"image","subtype":"png","icon":"https:\/\/www.esri.com\/arcgis-blog\/wp-includes\/images\/media\/default.png","width":1132,"height":300,"sizes":{"thumbnail":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09-213x200.png","thumbnail-width":213,"thumbnail-height":200,"medium":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09.png","medium-width":464,"medium-height":123,"medium_large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09.png","medium_large-width":768,"medium_large-height":204,"large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09.png","large-width":1132,"large-height":300,"1536x1536":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09.png","1536x1536-width":1132,"1536x1536-height":300,"2048x2048":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09.png","2048x2048-width":1132,"2048x2048-height":300,"card_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09-826x219.png","card_image-width":826,"card_image-height":219,"wide_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/08\/2023-08-18_12-28-09.png","wide_image-width":1132,"wide_image-height":300}},"image_position":"center","orientation":"horizontal","hyperlink":""},{"acf_fc_layout":"content","content":"

          This completes the SAML Certificate Rotation requirements for all organizations.<\/h3>\n

           <\/p>\n

          \n"},{"acf_fc_layout":"content","content":"

          Troubleshooting<\/h2>\n

          Upon signing in with a SAML Identity to ArcGIS Online, if you encounter one or more of the following errors, see the guidance below:<\/p>\n