SCIM provisioning can be used without having to turn on SSO, but only with a self-hosted configuration.

Use self-hosted SSO and SCIM to integrate Dashlane with your IdP

Many organizations use an Identity Provider to manage and authenticate members' access to applications and software with SSO and SCIM. Popular Identity Providers include Azure, Okta, and Google Workspace.

You can use many SAML 2.0 Identity Providers, including Azure, Okta, and Google Workspace.

While many password managers wouldn't be secure with SSO, Dashlane uses an encryption service to allow for SSO while retaining our zero-knowledge architecture. That way, data stored in Dashlane remains encrypted. Neither Dashlane nor your Identity Provider has your encryption key, so even if either experienced a breach, no one could access your data.

Explore Dashlane's Security Principles & Architecture

Your logins and personal information are always "encrypted" in Dashlane. Encryption scrambles your data so no one can read it. A unique encryption key is needed to decrypt and access your encrypted data.

An "encryption service" is a service that provides that unique encryption key. Without SSO, your Master Password acts as the encryption key because only you know it. With SSO, we need a way to verify your identity to your Identity Provider without a Master Password. That's what the encryption service is for.

We require anyone setting up SSO or SCIM with Dashlane to use an encryption service. It's an essential layer of our zero-knowledge architecture that protects your data in the event of a breach.

We offer two options for your encryption service—Dashlane Confidential SSO and self-hosted SSO.

The encryption service can benefit your organization more than competitor solutions. End-to-end encryption and encrypted sharing keys require a necessary layer of security that SAML and SCIM don't provide out of the box. You can use the encryption service to seamlessly integrate Dashlane with these protocols while keeping the encryption keys secure and the experience intuitive for the plan members and admins.

This graphic explains how the encryption service fits in the SSO and SCIM architecture:

Because the Dashlane SSO connector needs to communicate with your Identity Provider to verify your login, you need to be connected to the internet to log in to your Dashlane account with SSO. However, SSO members with biometric unlock enabled on their mobile devices can access their vault using biometrics.

Learn how to turn on biometric unlock

If an employee created a Dashlane account before joining your plan and before you verified your organization's email domain, you'll see a message in the Users tab of the Admin Console. This message gives you the option to download a CSV of employees who:

• Have accounts using your organization's verified email domain and have logged in to Dashlane in the last 90 days
• Haven't yet been invited to join your plan

Yes, VDI is fully supported with Dashlane SSO.

If you use Azure as your IdP, these steps can help you renew your certificate.

If you use a different IdP, these steps may still provide guidance, or you can contact support.

Contact an agent through the Admin Console

If you prefer, watch the Azure video of these steps

1. In a new browser tab, open the Azure Portal and search for or select Enterprise Applications.
2. Select your Dashlane app from the list of applications.
3. Select Single sign-on from the menu.
4. Select Edit the SAML Certificates and then select New Certificate. A new certificate appears in the list with the Status.
5. Select Save. A notification appears that your certificate has been updated, and the status for the new certificate will be updated to "Inactive."
6. Select the 3-dot menu for the new "Inactive" certificate, select Make certificate active, then select Yes to confirm.
7. Select the 3-dot menu for the "Inactive" certificate, select Delete Certificate, then select Yes to confirm. A notification appears that your certificate has been deleted.
8. Return to the Single sign-on page and dismiss the pop-ups. Scroll to SAML Certificates and select Download for the Federation Metadata XML.
9. Open the downloaded file in a text editor, select all of the text, and copy it to your clipboard.
10. Select the Dashlane D icon in your browser's toolbar and enter your admin Master Password if prompted. In the extension pop-up, select More and then Open the Admin Console.
11. In the Integrations section of the side menu, select Single sign-on, and then Edit Confidential SSO or Edit Self-hosted SSO depending on your configuration.
12. Select Edit for SSO settings.
13. Optional: Copy and save the text in the Add identity provider metadata text box for your records.
14. Then delete all of that text and paste the text you copied earlier.

15. Select Save changes.

    If the metadata contains more than one certificate, the Dashlane Admin Console displays an error message. If an error appears when saving the new metadata, double-check that you deleted the inactive certificate in step 7.

16. Select Test the SSO connection to confirm the update was successful.
17. Ask a team member to test the login.

Watch our video showing how to renew a certificate on Azure.

If you get this error, try these troubleshooting steps:

1. Ensure your members and groups are assigned to the Dashlane SAML app you created in your IdP during setup.
2. Make sure your browser profile is signed in with the same email address. Checking this is important for admins who use multiple profiles on Google Chrome browsers.
3. Ensure your Entity ID and ACS URLs match those in your Admin Console and that the Entity ID isn't missing the "/" at the end.
4. Ensure the member is logging in with the email address displayed in the Admin Console.