LogoLogo
SSO Connect On-Prem
SSO Connect On-Prem
  • Keeper SSO Connect On-Prem
  • Overview
  • System Requirements
  • Installation and Setup
    • Admin Console Configuration
    • Installation - Windows
    • Installation - Linux
      • GUI Configuration
      • Linux Command-line Configuration
      • Running Keeper SSO Connect as a Service on Linux
  • Identity Provider Setup
    • AD FS Configuration
    • Entra ID/Azure AD Configuration
    • AWS SSO Configuration
    • Centrify Configuration
    • F5 Configuration
    • G Suite (Google Workspace) Configuration
    • JumpCloud Configuration
    • Okta Configuration
    • OneLogin Configuration
    • Ping Identity Configuration
    • PingOne Configuration
    • RSA SecurID Access
    • Generic SAML Configuration
  • SSL Certificate Creation
  • High Availability (HA) Configuration
  • Integration with AWS CloudHSM
  • Integration with Gemalto HSM
  • Upgrading SSO Connect On-Prem
  • Update Instructions
  • Updating On-Prem Config
  • Migrating to a new SSO Connect Server
  • Service Management
  • Troubleshooting & FAQs
  • SSO Migration to Cloud
  • Technical Support
  • Links and Resources
  • Docs Home
Powered by GitBook

Company

  • Keeper Home
  • About Us
  • Careers
  • Security

Support

  • Help Center
  • Contact Sales
  • System Status
  • Terms of Use

Solutions

  • Enterprise Password Management
  • Business Password Management
  • Privileged Access Management
  • Public Sector

Pricing

  • Business and Enterprise
  • Personal and Family
  • Student
  • Military and Medical

© 2025 Keeper Security, Inc.

On this page
  • Overview
  • Prerequisites
  • Setting up Migration to SSO Connect Cloud

Was this helpful?

Export as PDF

SSO Migration to Cloud

Keeper provides automated migration from your SSO Connect On-Prem instance to Cloud SSO.

PreviousTroubleshooting & FAQsNextTechnical Support

Last updated 3 years ago

Was this helpful?

Overview

Keeper now supports an automated process for migrating your users from SSO Connect On-Prem to Keeper SSO Connect Cloud.

When migrating to SSO Connect Cloud, there is a change in the user experience, specifically in regards to new device approvals. Please ensure that you read the documentation.

Note: This migration process does not include device approvals. Device approvals will need to be configured using one the standard Keeper methods as documented . Users and admins can also manually process device approvals until an automated method is set up.

IMPORTANT We recommend scheduling and planning migration with a Keeper support engineer before you start the process.

IMPORTANT DO NOT DELETE your existing On-Prem SSO instance until after 100% of users have migrated. DO NOT DELETE the On-Prem Keeper application from your identity provider until after 100% of users have migrated. Both instances must remain active until all users have logged in at least one time, and until all migration is completed.

Prerequisites

  • Ensure that all of the on-premise IdP users are also provisioned in the Cloud IdP instance. For example, inside Azure ensure that users are assigned to the SSO Cloud enterprise application.

  • For devices to be automatically approved as part of this SSO migration process, we recommend installing Keeper Automator. Instructions for provisioning Keeper Automator can be found here:

Setting up Migration to SSO Connect Cloud

Start in the Keeper Admin Console by accessing "Admin" from left-side menu. Select a node with the on-premise SSO Connect instance where users are migrating from.

Now add a new SSO Connect Cloud provisioning method inside that same node. A popup message will appear that explains if the user continues, Keeper will assume that user authentication is moving to the cloud. Select "Continue" to complete the migration setup.

Configuration of the new SSO Connect Cloud environment can be done before or after SSO migration has started. In the event that the SSO Connect Cloud environment is setup after migration begins, the SSO Connect Cloud instance will show as "Pending" during migration.

Your SSO Connect Cloud environment can be setup using the process described here:

Note that during setup of your new SSO Cloud instance, you are asked to specify an "Enterprise Domain". This is simply a unique identifier that is used to reference the identity provider configuration. It isn't actually a domain name, it's just an arbitrary identifier that you can set to anything. If you used your domain name for the on-prem instance (e.g. company.com), the new SSO Cloud Enterprise Domain could be set to something like new.company.com or whatever you like. Ideally it would be something users can remember.

Once setup of your SSO Connect Cloud instance is completed, make sure that you test the process with a new user. Ensure that new users are able to authenticate with the SSO Cloud instance and ensure that you're able to approve devices.

After assigning Keeper SSO Connect Cloud to a node with Keeper SSO Connect running, Keeper will begin the migration and the provisioning screen will show the status "Migration in Progress" along with the number of users migrated to SSO Connect Cloud.

During the migration process, both on-prem and cloud instances must remain intact. This is a slow roll migration which is performed as end-users login.

When existing and new users log in, they will automatically be moved and authenticated using the SSO Connect Cloud. If the SSO Connect cloud environment has not been set up yet, the cloud instance will show a status of "Pending" instead of "Active".

When the cloud instance is in a "Pending" state, The users can still be migrated in Keeper indicating they have logged in and a key exchange has occurred which will allow them to be provisioned via SSO Connect Cloud when it is activated. The migrated users will still be authenticated using the on-premise SSO Connect until the SSO Connect Cloud environment is activated.

Keep in mind the On-Prem SSO and the Cloud SSO each have unique "Enterprise Domains" configured. To prevent the user from inadvertently logging back into the On-Prem instance when trying to migrate to the Cloud instance, click on the "Back" button to navigate away from the Enterprise Domain screen and start the authentication with the user's email address.

When all users have finally logged into Keeper and have been migrated to SSO Connect Cloud, the migration status will change to "Migration Complete". If the SSO Connect Cloud is also "Active", then the message under "Migration Complete" will include the instruction: "You can delete the SSO Connect On-Prem Method for this node."

Do not delete SSO Connect on-premise provisioning method for this node until 100% of the users have fully migrated and Keeper informs you that deletion is safe.

At any point during the SSO migration, the administrator can export a migration status report in CSV format. For each SSO user, the report shows: user UID, user name, user email address and the user's migration status.

If any users do not successfully migrate to SSO Connect Cloud using this automation process, these users can be moved using a manual process described in the following document:

SSO Connect Cloud
here
https://docs.keeper.io/sso-connect-cloud/device-approvals/automator
Keeper SSO Connect® CloudSSO Connect Cloud
Migration from On-PremSSO Connect Cloud
Logo
Logo
Select Single Sign-On with SSO Connect Cloud
SSO Connect Cloud Pending
SSO Migration in Progress
SSO Migration Complete