Setting up single sign-on for your human capital management platform eliminates password fatigue and tightens organizational security. When employees use corporate directory credentials to access Dayforce, IT teams spend fewer hours resetting locked accounts and dealing with credential-based security alerts.
Configuring single sign-on inside Dayforce requires matching Security Assertion Markup Language metadata between your identity provider, such as Microsoft Entra ID or Okta, and your Dayforce HCM tenant. Missing a single trailing slash or misconfiguring attribute claims will cause authentication loops that lock users out during peak payroll hours.
Understanding Dayforce Single Sign-On Architecture
Dayforce operates as a Service Provider in the single sign-on framework, meaning it delegates authentication to an external Identity Provider. When an employee attempts to log in, Dayforce redirects the user browser to the identity provider.
Once the identity provider verifies the user credentials, it issues a cryptographically signed XML document called a SAML assertion back to Dayforce. Dayforce reads this assertion, matches the unique user identifier, and grants access without ever storing or handling the corporate password. For another perspective on this event, see the latest update from Reuters.
This architecture supports two distinct login flows:
- Service Provider Initiated Login: The user visits your specific Dayforce tenant URL and clicks a corporate login button. Dayforce automatically redirects them to your identity provider login page.
- Identity Provider Initiated Login: The user logs into their corporate dashboard, such as an Okta or Microsoft portal, and clicks the Dayforce application tile to open the platform directly.
Essential Prerequisites Before Configuration
Before touching any configuration settings inside your identity provider or Dayforce tenant, confirm that specific structural prerequisites are in place to avoid common setup failures.
You need an active Dayforce HCM tenant with administrative security access. Specifically, the user account performing the integration must possess System Administrator permissions to modify security settings and single sign-on parameters.
Your corporate identity provider environment requires administrator rights, such as Global Administrator or Application Administrator in Microsoft Entra ID, to register enterprise applications and configure SAML settings.
User accounts must already exist in both systems. Single sign-on authenticates existing identities; it does not automatically provision brand-new user profiles inside Dayforce unless you have a separate user provisioning bridge configured. Verify that employee usernames or corporate email addresses match precisely across both active directories.
Step-by-Step Configuration Guide
Configuring the integration requires precise coordination between your identity provider dashboard and Dayforce administration menus.
Step 1: Register the Application in Your Identity Provider
Log into your identity provider console, such as Microsoft Entra ID or Okta, and create a new non-gallery enterprise application named to reflect your deployment, such as Corporate Dayforce HCM. Navigate to the single sign-on menu and choose the SAML protocol option.
Step 2: Configure Basic SAML Parameters
In the basic SAML configuration panel, you must input three core values extracted from your Dayforce tenant metadata XML file:
- Identifier (Entity ID): This string uniquely identifies Dayforce to your identity provider and must match the format provided in your tenant metadata, typically structured as
https://[your-tenant-name][.ceridiandayforce.com/Dayforce/](https://.ceridiandayforce.com/Dayforce/). - Reply URL (Assertion Consumer Service URL): The exact endpoint where your identity provider sends the signed SAML token. Include trailing slashes precisely as specified in the Dayforce documentation.
- Sign on URL: The primary entry point URL for your specific Dayforce tenant environment.
Step 3: Map User Attributes and Claims
Dayforce requires specific attribute statements to map incoming SAML tokens to the correct user profile. Configure the unique identifier claim to map to the user's primary email address or employee username matching the value stored in the Dayforce database. If these identifiers drift or mismatch by a single character, authentication fails silently or throws generic error codes on the login screen.
Step 4: Import Metadata into Dayforce
Download the federation metadata XML file from your identity provider portal. Navigate inside Dayforce HCM to the system administration modules and locate the security settings and single sign-on configuration screens. Upload your identity provider metadata, configure your signing certificates, and save the settings. Enable the single sign-on login method for your target security roles.
Managing Mobile App Authentication
Configuring browser-based single sign-on does not automatically configure access for the native Dayforce mobile application. Mobile access requires explicit configuration within your tenant settings.
Organizations must enable the network login credential requirement inside the mobile app configuration menu. When mobile single sign-on is active, users open the mobile application, enter their corporate company identifier, and get redirected to the organization browser authentication flow before returning to the app interface.
Common Configuration Pitfalls and Troubleshooting
Even experienced administrators run into predictable roadblocks during rollout. Knowing what breaks helps you shorten troubleshooting cycles.
- Mismatched Entity Identifiers: A trailing slash omission or an outdated subdomain in the Identifier field will cause the identity provider to reject authentication requests instantly.
- Certificate Expiration: SAML signing certificates typically expire after one or two years. When certificates roll over, authentication breaks across the entire company until the new metadata is imported into Dayforce.
- User Name Inconsistencies: If your identity provider sends user principal names that use corporate aliases while Dayforce stores employee records using formal email addresses, authentication will fail to resolve the user profile.
You can review official configuration documentation on the Dayforce Help Portal to verify specific menu paths and security parameters for your current release version.
Frequently Asked Questions
Does single sign-on automatically create new user accounts in Dayforce?
No. Single sign-on only handles authentication for profiles that already exist within the platform. You must create employee profiles through your standard HR onboarding workflows or via automated user provisioning integrations before they can log in.
What happens when an employee leaves the company?
When you disable or terminate an identity provider account in your corporate directory, that user loses the ability to generate valid SAML assertions. This immediately cuts off their access to Dayforce and any other connected enterprise applications.
Can we enforce multi-factor authentication through single sign-on?
Yes. Because authentication happens at your identity provider level, any multi-factor policies, conditional access rules, or risk-based verification steps enforced by your directory provider automatically apply to Dayforce logins.
How do we handle emergency administrative logins if identity provider services fail?
Dayforce allows administrators to maintain designated emergency break-glass accounts that bypass single sign-on and use native local database authentication. Secure these credentials carefully and restrict their usage strictly to platform outages.
