Establishing secure connection…Loading editor…Preparing document…

SSO Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SSO AGREEMENT

This Single Sign-On Agreement ("Agreement") is entered into as of by and between:

Recitals

WHEREAS, Service Provider operates and licenses a software application and related services requiring user authentication and desires to permit users of Client to authenticate via Client's identity provider using Single Sign-On (SSO) protocols under the terms set forth herein;

WHEREAS, Client maintains an identity provider (IdP) or uses a third-party IdP and seeks integration with Service Provider's service to enable federated authentication for its authorized users; and

WHEREAS, the parties wish to define the technical responsibilities, payment terms, confidentiality, security obligations, term, and termination rights applicable to the SSO integration and ongoing support.

Scope of Work

Service Provider shall: (a) implement and test SSO integration using mutually agreed protocols (e.g., SAML 2.0, OpenID Connect) and technical artifacts provided by Client; (b) provide configuration guidance, metadata exchange, and at least one test environment validation; and (c) deliver documentation of the integration and a production cutover checklist.

Payment Terms

If any undisputed amount due under this Agreement is not paid within days after the due date, interest shall accrue on the overdue amount at a rate of until paid. Parties agree that Service Provider may suspend provisioning or support for Client's SSO integration for amounts overdue beyond days following written notice.

Term and Termination

The term of this Agreement shall commence on and continue until unless earlier terminated in accordance with this Section.

Either party may terminate this Agreement for convenience upon providing days' prior written notice to the other party. Either party may terminate immediately upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice specifying the breach.

Upon termination, Service Provider will return or destroy Client data transmitted for the purpose of SSO integration in accordance with the parties' agreed procedures, and Client shall pay all undisputed fees accrued through the effective date of termination.

Confidentiality

Each party (the "Receiving Party") shall keep confidential and shall not disclose to any third party any non-public technical, business, or security information ("Confidential Information") received from the other party (the "Disclosing Party") in connection with this Agreement. Confidential Information includes, without limitation, integration details, metadata, credentials, security configurations, and any non-public documentation.

The Receiving Party shall protect Confidential Information with at least the same degree of care it uses to protect its own confidential information, but no less than reasonable care. Confidential Information does not include information that: (a) is or becomes publicly available without breach of this Agreement; (b) was rightfully known by the Receiving Party prior to disclosure; (c) is lawfully received from a third party without restriction; or (d) is independently developed by the Receiving Party without use of the Disclosing Party's Confidential Information.

Security and Data Handling

Service Provider shall implement and maintain reasonable technical and organizational measures to protect data exchanged in connection with SSO, including encryption in transit, access controls, and secure handling of authentication tokens and metadata. In the event of a security incident affecting Client data, Service Provider will notify Client without undue delay and cooperate in remediation and regulatory response as required by applicable law.

Representations and Warranties; Liability

Each party represents that it has full corporate power and authority to enter into this Agreement. Service Provider warrants that it will perform the integration services in a professional manner in accordance with industry standards. EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT, NEITHER PARTY MAKES ANY OTHER WARRANTY, EXPRESS OR IMPLIED. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of without regard to its conflict of laws principles.

Entire Agreement

This Agreement, including any exhibits and appendices executed by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral. Any modification must be in writing and signed by authorized representatives of both parties.

Miscellaneous

Neither party may assign this Agreement without the prior written consent of the other, except to an affiliate or in connection with a merger or sale of substantially all assets, provided that the assignee assumes all obligations hereunder. The parties are independent contractors and nothing in this Agreement creates a partnership, joint venture, or agency relationship.

Service Provider (Party A):

By:

Date:

Client (Party B):

By:

Date:

Enter text✕

What the SSO Agreement Covers

An SSO Agreement is a contract that defines responsibilities, technical requirements, security controls, and service levels for a Single Sign-On integration between a service provider and a relying party. It sets the authentication protocol (SAML, OIDC), metadata exchange, certificate handling, testing and roll‑out procedures, and confidentiality obligations. The agreement also addresses incident response, liability caps, and termination conditions to reduce operational and legal risk when delegating user authentication to a third‑party identity provider or enterprise IdP.

Why a Formal SSO Agreement Matters

A written SSO Agreement clarifies technical expectations and legal responsibility, reduces integration delays, and documents security controls required for compliance. It preserves evidence of consent, scope, and retention that supports enforceability under ESIGN (15 U.S.C. ch. 96) and UETA where applicable.

Why a Formal SSO Agreement Matters

Typical Parties and Teams Involved

Multiple stakeholders usually participate in drafting and approving an SSO Agreement.

  • Enterprise IT and Identity teams responsible for IdP/SP configuration and ongoing authentication maintenance.
  • Security, compliance, and legal teams that review controls, data sharing, and liability language before execution.
  • Application owners and vendor account teams who validate user provisioning, deprovisioning, and integration testing.

In medium and large organizations these roles ensure technical correctness, legal protection, and operational readiness prior to go‑live.

Core Sections to Include in an SSO Agreement

A professional SSO Agreement groups legal, technical and operational terms so both parties can implement, test, and support the integration reliably.

Parties & Definitions

Identify legal entities, key contacts, and glossary terms such as IdP, SP, Assertion, Audience, and relying party responsibilities in plain language for clarity.

Scope of Integration

Describe which applications, user populations, and environments (production, staging) are covered, including limits on delegated authentication and accepted protocols.

Authentication Methods

Specify supported protocols (SAML 2.0, OpenID Connect), allowed authentication contexts, MFA requirements, certificate lifecycle, and signing/encryption expectations.

Service Levels

Define availability targets, scheduled maintenance windows, incident response times, escalation contacts, and rollback procedures for failed deployments.

Security & Privacy

Include data minimization, encryption in transit, breach notification timelines, applicable privacy law obligations, and whether a HIPAA BAA is required.

Liability & Termination

Set indemnities, liability caps, termination triggers (material breach, key compromise), transition assistance, and post‑termination account access handling.

Essential Information to Provide

Legal Entity: Full registered company name
Primary Contact: Name, role, email
SSO Protocol: SAML 2.0 or OpenID Connect
IdP Metadata: Metadata URL or XML blob
Certificate Details: Thumbprint and expiry date
Assertion Consumer: ACS URL and audience

Step-by-Step: Execute an SSO Agreement

Follow these stages to complete the agreement, configure SSO, and move to production with minimal disruption.

  • 01
    Prepare Materials: Collect metadata, certs, and contact info.
  • 02
    Draft & Review: Legal and security review contract text.
  • 03
    Exchange Metadata: Swap IdP/SP metadata and certificates.
  • 04
    Test & Launch: Perform test users, then enable production.

Typical Configuration Settings for Online Completion

Common workflow settings streamline online completion and reduce manual handoffs during SSO configuration.

Field Configuration
Authentication Protocol SAML 2.0 | OIDC (choose one)
Assertion Lifetime Short-lived tokens, typically 5–10 minutes
Authn Context Require MFA or PasswordProtectedTransport
Metadata Handling Automated fetch or signed XML upload

Where to Send, File, and Store the Agreement

Choose secure distribution paths and a primary repository to avoid version conflicts and ensure auditability.

  • Upload Agreement: Store signed copy in vendor contract repository
  • Send to Legal: Deliver executed PDF to corporate counsel
  • Publish Metadata: Add trusted IdP metadata to production
  • Archive Copies: Retain final signed PDF in secure archive

Technical and Platform Requirements

Confirm platform compatibility, supported document formats, and integration endpoints before you begin signing electronically.

  • File Formats: PDF and DOCX supported
  • Integrations: Salesforce, NetSuite, Google Workspace
  • Authentication: SAML/OIDC plus optional 2FA

Use a secure eSignature platform that supports audit trails, TLS 1.2/1.3 encryption, and the export formats your records team requires to ensure long-term access and compliance.

eSignature Vendor Pricing & Feature Snapshot

Select a signing platform that supports audit trails, encryption, and required integrations; the table below compares starting prices and common features.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial, no credit card No No Yes, limited Yes, limited
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Practical Tips for Accurate and Efficient SSO Agreements

Follow these best practices to shorten negotiation cycles and reduce operational risk when implementing SSO integrations.

Use a Standard Template
Maintain a vetted SSO Agreement template that covers protocol specifics, required metadata elements, security controls, and BAA language where needed; reusing a standard reduces legal review time and ensures consistent requirements.
Pre-Collect Technical Artifacts
Ask the partner to supply IdP metadata, cert thumbprints, and test accounts prior to contract signature; prebuilt artifacts accelerate configuration and help avoid repeated amendments.
Require Testing & Rollback
Include formal test plans, rollback triggers, and a staged cutover process to limit outage risk and provide clear acceptance criteria before enabling production authentication.
Document Key Contacts
Record technical, security, and legal contacts with escalation procedures in the agreement; clear handoffs reduce mean time to repair for incidents.

Common Mistakes to Avoid

  • Omitting exact metadata or certificate thumbprints, causing configuration mismatches and failed authentication attempts during deployment.
  • Not specifying MFA or AuthnContext requirements, which can leave apps exposed or violate internal security policies.
  • Failing to test assertion expiration and clock skew, leading to intermittent login failures for users in production.
  • Neglecting to address certificate rotation procedures, which causes urgent outages when signing certificates expire.

Material Risks and Contractual Consequences

Security Breach: Potential regulatory fines
Service Outage: Operational and reputational damage
Noncompliance: Breach of industry regulations
Termination: Loss of access and transition costs
Data Notification: Breach reporting obligations
Invalid Execution: Risk of unenforceable terms

Real-World Examples of SSO Agreements in Use

These brief examples show how organizations use SSO Agreements to standardize integrations and protect operations.

Tech Data (Enterprise Integration)

Tech Data streamlined contract terms for integrations across business units

  • Negotiated unified metadata exchange and SLAs
  • The result was faster onboarding across subsidiaries and clearer escalation paths for identity incidents, improving internal and external customer response times.

Xerox (ERP & SSO)

Xerox used a standardized SSO Agreement tied to NetSuite integration

  • Included certificate rotation procedures and role mapping
  • This reduced repeated legal reviews and allowed faster, repeatable deployments for new business units while preserving security controls.

Frequently Asked Questions About SSO Agreements

Answers to common questions about execution, e-signing, notarization, revocation, and legal validity for SSO Agreements.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users