Moving from standard signing in to SSO sign in on qlik cloud

[qliksense1thomascook]

Hello all,

We are trying to move from standard default login from to SSO login on qliksense cloud. Created the Identity Provider in Azure and configured the same in qlik. Verified it as well but before implementing we had below few concerns which we need to get clarified. 

1. If implemented SSO, what kind of effect will it have on logins? Will it affect all the users or specific users mentioned in Azure portal?

2. Will it effect the tenant ID and admin roles and logins as well? Do we have to re-allocate Tenant/admin/user roles again? If so, how can we do that?

3. If we move to SSO, will there be any discrepancies on Apps assigned to already allocated license users?

4. Can we have both SSO and standard default login using email ID on qlik cloud? If yes, how to configure that?

5. Can we implement session sign out after a period of inactivity after implementing SSO on qlik cloud? If yes, how to configure that?

6. I know it is not completely possible but still can we have a backup option to roll back if some thing goes wrong after implementing SSO?

Looking forward to get these clarified. Thanks in advance.

[Eduardo_Monteiro · Accepted solution]

Hi @qliksense1thomascook 

Please see below:

1. Login impact — who is affected? Only users assigned to the Qlik Cloud app in Azure AD are affected. Everyone else continues as before. Once SSO is active, those users must log in via Azure AD — no more Qlik Account password.

2. Tenant ID, admin roles — do they need to be re-allocated? Tenant ID is unaffected. Roles are preserved only if the email/identity claim from Azure AD exactly matches the existing Qlik Cloud account. If it matches — no action needed. If it doesn't — Qlik creates a new user record, and roles must be manually reassigned in the Management Console.

3. App access/license assignments — any discrepancies? Only if the identity claim changes. Same email = everything preserved. Different email/UPN = new user record, licenses, and app access are lost and must be reassigned manually. Validate email matching before go-live.

4. Both SSO and standard email login simultaneously? No. Qlik Cloud only supports one active interactive IdP per tenant. Activating Azure AD SSO deactivates the Qlik Account login entirely. The only workaround is using a federated IdP (e.g., Keycloak, Auth0) that itself offers multiple login options — but that adds an extra layer.

5. Session timeout after inactivity? Yes. Two places to configure it: in Qlik Cloud go to Management Console → Settings → Session timeout for idle timeout. On the Azure AD side, use Conditional Access → Sign-in frequency to force re-authentication after a set period.

6. Rollback option? Partial. Before enabling SSO, create a Tenant Admin account while Qlik Account is still active — this becomes your emergency access. If SSO breaks, log in with that account, go to Management Console → Identity Provider, and deactivate the Azure AD IdP. Qlik Account login is restored immediately. Note: Any users provisioned only through SSO won't be able to log in until SSO is restored or they're re-invited.

Regards,

[qliksense1thomascook]

Dear @Eduardo_Monteiro,

I really appreciate you taking out your time to help us and we were able to get the first 5 points clarified. However, we need further clarification regarding rollback and emergency access as part of our SSO rollout with Microsoft Azure Active Directory in Qlik Sense Cloud.

Currently, our Service Account Owner (Tenant Admin) is also part of Azure AD. Other Tenant Admins apart from SAO are also part of Azure AD. Based on this, we understand that once SSO is enforced, authentication for this account will also be routed through Azure AD.

This raises a critical concern:

In the event of:

• Azure AD outage
• Conditional Access misconfiguration
• SSO configuration issues

we may face a complete administrative lockout of the tenant.

Can you please help me with the following:

1. Does a Service Account Owner that exists in Azure AD still depend on the IdP for authentication after SSO is enabled?
2. Is it mandatory to maintain a separate Qlik Account (non-Azure AD identity) as a break-glass Tenant Admin for recovery purposes?
3. Can such a non-AD account only access the tenant via the /login/recover endpoint?
4. Are there any alternative or recommended mechanisms from Qlik to ensure guaranteed administrative access independent of the IdP?

Looking forward to your guidance.

[Daniele_Purrone · Accepted solution]

Hi @qliksense1thomascook ,

if needed, the SAO can use the recovery link to access the tenant and modify the IdP settings. This will go through the Qlik Account... so, if the IdP doesn't work, the SAO will still be able to access the admin pane.

So, to answer your questions:

1. Does a Service Account Owner that exists in Azure AD still depend on the IdP for authentication after SSO is enabled? 
   When using the recovery link, the SAO will bypass the IdP. For normal login, they will use the IdP.
2. Is it mandatory to maintain a separate Qlik Account (non-Azure AD identity) as a break-glass Tenant Admin for recovery purposes?
   The way it works, it's not a separate account. It's the same one, but it will access the tenant via the QlikId when using the recovery link.
3. Can such a non-AD account only access the tenant via the /login/recover endpoint?
   No, that user will normally access the tenant by using the IdP when not using the recovery link.
   Only when using the recovery link, the IdP will be bypassed.
   
4. Are there any alternative or recommended mechanisms from Qlik to ensure guaranteed administrative access independent of the IdP?
   Not at the moment, but feel free to add any suggestion to our ideation page.
   
   

[Eduardo_Monteiro]

Hi @qliksense1thomascook 

Also, You can use federated ldp alternatively, allowing you to have multiple platform access as I mentioned:

4. Both SSO and standard email login simultaneously? No. Qlik Cloud only supports one active interactive IdP per tenant. Activating Azure AD SSO deactivates the Qlik Account login entirely. The only workaround is using a federated IdP (e.g., Keycloak, Auth0) that itself offers multiple login options — but that adds an extra layer.

I personally tested Auth0, and it worked well. Allowing me to have multiple groups of users from different sources.

Regards,

[Daniele_Purrone]

Yes, Auth0 works with multiple sources. However, Qlik Account is not one of them.