Configure external user single sign-on

Platform customers with multiple users can collaborate with The Trade Desk to configure user single sign-on (SSO) access for their own users.

The Trade Desk platform is a federated service that uses Okta as the SSO identity provider for all client accounts. However, in some cases customers might prefer to use their own SSO solution. If you want to use your own identity provider, to give your own users a seamless login experience using your corporate credentials, contact your Account Manager for assistance to get started.

Benefits of external SSO configuration

A company-wide SSO solution provides a uniform interface for all employees in a specific company, allowing them to access authorized apps with just one login.

If you're a customer of The Trade Desk and have an SSO solution in place, you can set up an integration with sites owned by The Trade Desk so that you can use your own identity provider to manage access.

Types of SSO supported

The Trade Desk uses SAML to support all major identity providers, including the following:

• Okta
• Microsoft Entra (formerly Azure Active Directory)
• Ping Identity

Applications covered by external SSO

When an external account is enabled with SSO access, the access is applicable to multiple products and platforms offered by The Trade Desk, including the following:

• The Trade Desk platform (Desk UI)
• OpenTTD
• Edge Academy
• OpenPath UI

NOTE: For some of these, users might need one or more additional permissions. If needed, contact your Account Manager for the appropriate access.

Before you start

Before setting up SSO, make sure it's the right choice for you. Answer the following questions:

• What is your motivation for integrating your single sign-on solution with The Trade Desk platform?

• How do you currently authenticate users—which identity provider do you use?

• Do you have approval from your legal and security teams to integrate your SSO with The Trade Desk platform?

• If there are questions from The Trade Desk about your SSO setup, who will be the main point of contact in your company?

When you've addressed these points, and you are sure that this is the correct and approved solution for your company, contact your Account Manager to get started.

Setup process

The following table shows the high-level steps for setting up single sign-on access for The Trade Desk, and indicates the responsible party in each case. Each step has sub-steps.

The following sections provide instructions for each step.

Establish trust relationship between identity providers

To establish trust between identity providers, The Trade Desk and your technical team typically hold a short meeting, followed by an email exchange to finalize configuration details.

The process includes the following steps:

1. Both parties: Configure identity provider for federation.

2. Both parties: Securely exchange credentials for the identity provider.

3. You: Create a security group that contains the users who will have access to The Trade Desk platform.

   IMPORTANT: You must predefine the specific users. The Trade Desk does not support just-in-time provisioning.

4. The Trade Desk: Register you, the platform customer, as having an external identity provider available.

Test the functionality

To test the functionality, The Trade Desk and your technical team typically hold a brief meeting to verify the configuration, followed by an email exchange to confirm successful integration.

The process includes the following steps:

1. You: Using test accounts, test the functionality, including granting access and revoking access for specific accounts.
2. You: Create a spreadsheet to map between existing accounts with The Trade Desk and future accounts using the identity provider.
3. You: Document the accounts that will not use federation (usually API or service-type accounts).
4. You: Create and test the link to The Trade Desk application in these two ways:
   • From your in-client app gallery.
   • By going to the URL directly in the browser, not through the app gallery.

Test with small working group

To verify access and functionality before broader rollout, test with a small working group. The Trade Desk and your team can coordinate this entirely through email.

The process includes the following steps:

1. You: Select one or two users to be your testers.
2. You: Test granting of access and revoking of access of accounts, with and without prior TTD access.
3. You: When everything is verified, move those accounts into the application access group.
4. The Trade Desk: Alter existing accounts and create new accounts as needed.
5. You: Create and test the link to The Trade Desk application in these two ways:
   • From your in-client app gallery.
   • By going to the URL directly in the browser, not through the app gallery.

Make final migrations and configuration with mapping spreadsheet

To complete the final migrations and configuration, use the mapping spreadsheet that you created in Test the functionality Step 2. The Trade Desk and your team can coordinate this entirely through email.

The process includes the following steps:

1. You: Move specified accounts into application access group.
2. The Trade Desk: Alter existing accounts and create new accounts as needed to match Step 1.
3. The Trade Desk: Make sure non-federated accounts remain unaltered.
4. The Trade Desk: Communicate changes in the user provisioning process.
5. Both sides: Final testing.

Final signoff

When you're satisfied that the SSO functionality is working correctly, confirm through email.

IMPORTANT: The Trade Desk requires final approval from a senior manager in your company, in the form of an email acknowledging that access control is now managed through SSO using your own identity provider.

FAQs

The following are some commonly asked questions about setting up your own SSO for The Trade Desk platform.

What identity provider does The Trade Desk use?

The Trade Desk uses Okta for platform access. It supports all major identity providers. For details, see Types of SSO supported.

Does The Trade Desk platform support third-party single sign-on with SAML?

Yes. The platform supports SAML for third-party SSO setup.

Does The Trade Desk platform support third-party single sign-on with SCIM?

No. The platform does not support user provisioning with System for Cross-Domain Identity Management (SCIM).

Does The Trade Desk platform support third-party single sign-on with OpenID Connect (OIDC)?

No. For external SSO access, the platform currently supports only SAML.

Can an SSO implementation run in parallel with existing direct logins?

Yes. Any existing direct logins are not automatically affected by the SSO implementation. You can include existing accounts in a new SSO implementation, but there is a manual process to do so. Any existing logins that are not included in the manual process remain unchanged.

When SSO is implemented, are existing direct accounts carried over?

Not automatically. You can include existing accounts in a new SSO implementation, but there is a manual process to do so. As part of the SSO implementation, there is a one-time manual migration for existing accounts.

Is there a unique identifier for the accounts set up with access via a specific third-party SSO configuration?

Yes. The user's email address is the unique identifier.

To be successful, an SSO login attempt must match existing account information based on the email address of the user, which you must include as the subject identifier in the response claim.

Is the login account data private to a specific login account?

Yes.

Can external administrators get administrator access for configuring the SSO integration?

No. Administrator access is only available to certain company personnel authorized by The Trade Desk.

How can I contact someone who has administrator access to my third-party SSO account?

To contact an authorized individual, send details of what you need to this email address: platform.auth@thetradedesk.com. The message goes to authorized individuals in The Trade Desk Engineering Team.