Description

Ensure the OVHcloud account is connected to the organization's identity provider (for example Microsoft Entra ID, Okta, AD FS, or Google Workspace) through SAML single sign-on, so that users sign in with their company account and access is controlled centrally.

Rationale

With SSO, the company identity provider controls who can sign in, applies its MFA and access rules, and removes access as soon as a user is disabled. Without it, each person needs a separate OVHcloud login that must be managed by hand, so former staff may keep access.

Impact

  • Users sign in with their company account

  • Access is removed centrally when a user leaves

  • Groups in the identity provider must be mapped to OVHcloud groups

Default Value

By default, no SSO connection is configured.

Pre-Requisites

  • Access to the OVHcloud account owner login

  • Administrator access to the identity provider

  • The identity provider's SAML metadata

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities.

  4. Check whether an SSO connection is configured.

  5. If no SSO connection exists, follow the implementation steps.

Implementation Steps

  1. In your identity provider, create a SAML application for OVHcloud and download its metadata.

  2. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  3. In the left-hand menu, select Identity, Security & Operations.

  4. Under Identity and Access Management, select Identities.

  5. Select the option to set up an SSO connection, paste the identity provider metadata, and enter the Group attribute name.

  6. Choose whether to keep local OVHcloud users active (tick Keep active OVHcloud users if needed).

  7. Add the identity provider groups to OVHcloud and grant them access through IAM policies.

  8. Sign in with SSO to confirm it works.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities.

  4. Remove the SSO connection. Make sure the owner login or a local user can still sign in first.

Reference