SSOGEN / SSO Applications / NetSuite SSO: Sign In to NetSuite Through SSOGEN
Integration
NetSuite SSO: Sign In to NetSuite Through SSOGEN
NetSuite SSO with SSOGEN is granted role by role. You turn on the SAML Single Sign-on feature, add the SAML permission to the roles that should use SSOGEN, and send the email address on each employee record as the Name ID.
NetSuite SSO with SSOGEN takes people from their SSOGEN My Apps straight to their NetSuite home page, without the NetSuite login page. NetSuite is the SAML 2.0 service provider and SSOGEN is the identity provider. The SSOGEN App gallery has an Oracle NetSuite card that opens the registration wizard and links to Oracle’s own guide.
NetSuite’s design choice matters more than any single field: SAML access is a permission on a role, not a switch for the whole account. This page covers that model. The screen-by-screen setup is in Single sign-on for Oracle NetSuite with SSOGEN.
Access is granted per role
NetSuite has two SAML permissions:
| Permission | What it does |
|---|---|
| Set Up SAML Single Sign-on | Lets users other than administrators view and edit the SAML Setup page. The Administrator role already has it. |
| SAML Single Sign-on | Makes the role sign in to the NetSuite UI through SAML. A user with this permission cannot use the standard login page with a user name and password. |
To give a role SSO, open Setup, Users/Roles, User Management, Manage Roles, customize the role, and add SAML Single Sign-on on the Permissions, Setup subtab. Give the copy a name people recognize, for example with “SAML” in it.
Decide which roles go through SSOGEN
| Role | Recommendation |
|---|---|
| Everyday roles (finance, sales, operations) | Add SAML Single Sign-on. People sign in through SSOGEN only. |
| Administrator | Leave on the NetSuite login page, so an administrator can always reach the SAML Setup page. |
| Roles with SuiteAnalytics Connect permission | NetSuite does not allow the SAML permission on these roles. |
| Roles set to require two-factor authentication | Adding SAML makes NetSuite ignore its own 2FA requirement. Choose an SSOGEN sign-in policy with Plus a second factor for NetSuite instead. |
NetSuite also honors your company’s IP address rules for SAML sign-ins to the NetSuite UI, so existing network restrictions stay in force.
What NetSuite accepts in the assertion
NetSuite needs the user’s email address, in the Name ID or in an email attribute. If both are present, they must match.
| NetSuite accepts | Set in SSOGEN |
|---|---|
Name ID format emailAddress, transient or unspecified, always holding an email address |
Identify the person by: email — mail address |
| The email that matches the employee record | The person’s email in SSOGEN, which the Test card shows as NameID |
account attribute (optional) |
Leave it out unless you need it, see below |
The account attribute. It carries your NetSuite account ID. NetSuite requires it only when you also send a role or site attribute, or when users need both customer center and other SAML roles. Sending it locks people into one account, so they cannot switch to a sandbox that trusts the same identity provider.
Set up NetSuite and SSOGEN
- Turn on the feature. Setup, Company, Setup Tasks, Enable Features, subtab SuiteCloud, section Manage Authentication: check SAML Single Sign-on.
- Prepare roles. Add the SAML permission to copies of the roles you chose, and give one copy to a test user.
- Register NetSuite in SSOGEN. Select the Oracle NetSuite card and read NetSuite’s service provider metadata. NetSuite’s ACS URL is
https://system.netsuite.com/saml2/acs. - Load SSOGEN’s metadata. On NetSuite’s SAML Setup page choose Indicate IDP metadata URL with SSOGEN’s metadata address, or Upload IDP metadata File.
- Check Primary Authentication Method. Without it, a NetSuite link with no session lands on the NetSuite login page instead of SSOGEN.
- Assign, test, activate. Run Test for the test user, confirm the NameID is the email on their employee record, then activate.
Questions people ask
How do I set up NetSuite SSO with SSOGEN?
Turn on the SAML Single Sign-on feature, add the SAML permission to the roles that should use SSO, register the Oracle NetSuite card in SSOGEN with NetSuite’s metadata, load SSOGEN’s metadata on the SAML Setup page, check Primary Authentication Method, test and activate.
Does Oracle NetSuite support SSO?
Yes. NetSuite accepts any SAML 2.0 identity provider, including SSOGEN. Administrators control who uses SAML with role-based permissions, and people who sign in through SAML land directly on their NetSuite home page.
Is Oracle NetSuite an ERP or CRM?
Both. NetSuite runs finance and other ERP processes, and its help center documents CRM and sales force automation features for sales, marketing, partners and support. SSO with SSOGEN covers every NetSuite role you give the SAML permission, whichever features the role uses.
How do I change my password in Oracle NetSuite when SSO is on?
You do not. A role with the SAML Single Sign-on permission does not use a NetSuite password, so people change the password of their SSOGEN account or directory instead. Roles without the SAML permission keep their NetSuite password.
Where to go next
- Hub. The SSO applications hub has the protocol comparison and the other guides.
- More ERP. SSOGEN also signs people in to on-premises ERP; see ERP single sign-on.
- The SSOGEN screens. Register a SAML application describes each step of the wizard.
Sources, all read 2026-11-15 (Oracle NetSuite Help Center):