Microsoft SSO

Updated

Introduction

Microsoft Single Sign-On (SSO) allows organizations on Teams or Enterprise plans to automatically add new learners to their DataCamp group when they sign up using Microsoft Sign-in, with Microsoft acting as the identity provider (IdP).

Microsoft SSO is designed to simplify user onboarding. It does not control authentication for existing users and does not enforce Microsoft as a required login method. Learners can continue to sign in using a username and password.

This feature can be enabled and managed by group admins the Settings → SSO page.

⚠️ Important: How Microsoft SSO behaves

Microsoft can be used to login and sign up on DataCamp. However, joining the group via Microsoft SSO only applies for new users. Any existing users that use Microsoft to sign in will not be added to the organization.

Additionally, Microsoft SSO does not restrict or replace username/password login. Learners are free to use any login method they want.

Microsoft SSO is different from a SAML 2.0 SSO integration. To configure SAML 2.0 SSO with Microsoft Entra ID, please see our article here: Microsoft Entra ID (formerly Azure Active Directory) SSO Configuration Instructions

Prerequisites

To use Microsoft SSO, the following requirements must be met:

  • You are a Group Admin
  • Your group is on a Teams or Enterprise plan
  • At least one admin has an email address using the domain to be verified

Configure Microsoft SSO

Step 1: Enable Microsoft as your SSO provider

  1. Navigate to Settings → SSO
  2. Select Microsoft from the SSO provider dropdown

A domains table will appear where you can manage the domains associated with Microsoft SSO.

Step 2: Add an email domain

  1. Click Add domain
  2. Enter a domain your organization owns (for example, company.com)
  3. Save the domain

The domain will be added with the status Pending verification and your Microsoft SSO integration will be automatically enabled. However, it does not come into effect until at least one of your domains is approved.

You may add multiple domains if needed.

Verify a domain

Each domain must be verified before it can be approved and activated.

Step 3: Complete domain verification

  1. In the row containing the domain, click "Verify Domain". 
    1. Note: Your DataCamp account’s email domain must match the domain you are verifying (for example, @company.com). Otherwise, the button will not be shown.
  2. A verification email is sent to your inbox
  3. Click the verification link in the email
  4. You are redirected back to DataCamp

Once complete, the domain status updates to "Pending approval".

Domain approval

After verification:

  • DataCamp Support is automatically notified to review the newly verified domain
  • The domain is reviewed and approved by DataCamp

Approval usually takes a few hours, and should take no more than one business day.

Once approved, Microsoft SSO becomes active for that domain.

Learner experience

Sign-up

When a learner signs up using Microsoft Sign-in:

  • If their email domain matches an approved domain:
    • A DataCamp account is created
  • The learner is automatically added to your group

How it works:

  1. New user goes to https://www.datacamp.com
  2. User clicks on the "Microsoft login" button
  3. User successfully logins with their Microsoft account for your company's domain
  4. User is automatically created and added to your DataCamp group, and can immediately start learning

Sign-in

  • Users can continue to sign in using:
    • Username and password
    • Microsoft Sign-in (if they choose)
  • Microsoft SSO does not enforce Microsoft-based authentication

Email domain whitelisting

When a user without an existing DataCamp account attempts to sign in using the DataCamp sign-in page, we check their email domain. If it matches any of the domains you configured for Microsoft SSO, the user is automatically redirected to Microsoft. Upon successful authentication, they'll return to DataCamp with a newly created account and they'll be added to the group.

This ensures a smooth onboarding experience for new users who may attempt to sign in to DataCamp directly.

How it works:

  1. New user goes to https://www.datacamp.com
  2. User clicks on "Log in"
  3. User enters an email with your company's domain and clicks "Next"
  4. User is redirected to login to their Microsoft account for your company's domain
  5. On successful login, user is automatically created and added to your DataCamp group, and can immediately start learning

License handling

  • If licenses are available, access is granted immediately
  • If no licenses are available:
    • The learner is added to the waiting list
    • Access can be granted manually once licenses are added

Managing domains and Microsoft SSO

  • Microsoft SSO can be disabled at any time from the SSO settings page (Settings > SSO)
  • Domains that are not yet approved can be removed by a group admin
  • Approved domains currently require DataCamp Support assistance to remove. To remove an approved domain, please raise a support ticket specifying the approved domain you want to remove and we will address it as soon as we can.

Frequently asked questions

Does Microsoft SSO affect existing users?

No. It only applies to new users at the time of sign-up.

Are users required to log in with Microsoft?

No. Username and password login remains available.

Can I remove an approved domain myself?

Not at the moment. Approved domains can only be removed by DataCamp admins. You can disable Microsoft SSO entirely if needed.

Can I remove a domain that hasn’t been approved yet?

Yes. Group admins can remove domains that are still pending verification or awaiting approval.

What happens if we run out of licenses?

New users are added to the waiting list until licenses are available.