Upgrading to Opti ID

Yes, for net-new customers. Existing customers need to migrate by September 30, 2026. For on-prem or EU customers only, the deadline to migrate is December 31, 2026.

The goal is for all customers to use Opti ID to get the full benefits of Optimizely One.

No. Opti ID is a foundational service provided by Optimizely. Existing customers must migrate to Opti ID, and all net-new customers receive it by default.

Opti ID supports:

• Okta (using SAML SSO)
• Duo (using SAML SSO)
• PingOne (using OIDC SSO)
• PingFederate (using OIDC SSO)

Opti ID also supports:

• SCIM provisioning
• Local login
• Multi-factor authentication (MFA)

Resources:

• Configuring your own SSO for Opti ID
• Configure organizational domains
• Add external collaborators to an SSO organization
• Configure SAML SSO with Duo
• Configure SSO with Entra ID
• Configure SSO with Google
• Configure SSO with Okta
• Configure SSO with OneLogin
• Configure SSO with PingOne
• SCIM Provisioning

Opti ID supports both SAML and OIDC for connections with your identity provider (IdP). A new SSO connection is required for Opti ID; your existing SSO setup cannot be reused. The above resources will guide you through the process or you can contact Optimizely Support for more assistance.

Yes. You can enable MFA for added security.

Resource: Set up multi-factor authentication

Yes. Non-SSO customers can log in as a local user using email and password. This is enabled by default—no request is needed.

Resource: Add external collaborators to an SSO organization

Yes. Organizations can provision and sync users via SCIM. You can also generate SCIM tokens yourself.

Resources:

• SCIM provisioning

• How to generate a SCIM token in Opti ID

No. The main benefit of Opti ID is single login access to all your entitled products. You will only need to sign in again after your session expires (Okta-controlled timeout).

All users land on home.optimizely.com after authentication unless they are users with access to only one application instance in which case they are redirected directly to their instance.

Admins see home.optimizely.com, the global bar, and the product switcher with all purchased products/instances. They can access the Admin Center to manage users, roles, and entitlements quickly.

Non-admins land on home.optimizely.com with tiles of their entitled applications. The product switcher shows only the products and instances they have access to.

Yes. All Optimizely products include a login with SSO link that redirects automatically to Opti ID. However, we recommend updating any old bookmarked login pages with the new login.optimizely.com to ensure a more streamlined login flow.

Yes. We can customize the login screen to match your branding.

Resource: Brand your Opti ID login page

Password changes are required when switching to Opti ID:

1. Standard security practice when changing your authentication provider

2. For PII protection—Optimizely does not retain passwords, so they cannot be retrieved

The upper left corner of the global bar shows all the organizations you manage. You can switch between accounts seamlessly without needing to log in again, making it easy to assist each organization with the correct entitlements.

Only products that have been migrated to Opti ID appear in the product drop-down. If you have multiple products it is best for your Admin to coordinate the migration to be at the same time for all your products. This can be coordinated through your Optimizely CSM and Support engineer.

Additionally, a product may not appear if you haven’t been granted access through a role and entitlement. If you believe you should have access, contact your admin to be added to the appropriate group with the correct permissions.

You will only see products you are entitled to use. If you need access to other products, please reach out to your administrator to update your entitlements.

Yes. Opti ID uses HMAC to determine instance permissions for users in the context of CMP.

The Admin Center is the central place where admins manage their organization in Opti ID. Here, admins can:

• View and manage all entitlements
• Manage users and their product roles and permissions
• Create custom roles specific to their organization

The Admin Center will continue to expand, adding reporting tools and self-service capabilities, such as trials and freemiums.

(Resource: Administer Opti ID – Support Help Center (optimizely.com))

The technical contact for your organization is the primary admin for the organization. This user:

• Is the first official user in Opti ID with Admin Center access
• Can manage account settings, users, and entitlements
• Can invite additional users and assign them roles, including admin roles for specific products or across the account

Resource: Update technical contact

The CSM and Opti Support can help answer how-to questions or support an bugs/issues with Opti ID.

Yes. Admins can invite users directly through the Admin Center. The invitation workflow also lets admins track who has accepted their access.

No. Once your organization uses Opti ID, user management is centralized in the Admin Center.

Yes. The Admin Center is the single location for managing all users for organizations using Opti ID. As your organization moves roles and permissions to Opti ID, user and entitlement management will no longer occur in individual applications.

Resource: Manage users

Yes. Azure AD can be integrated with Opti ID, allowing automatic syncing of users and groups.

Resources:

• Configure organizational domains

• SCIM provisioning

No. Users can migrate automatically using Just-In-Time (JIT) migration or SCIM provisioning. Bulk upload functionality in the Admin Center is coming soon.

Resources:

• Configure organizational domains

• SCIM provisioning

Groups let you organize users with similar roles or entitlements, reflecting your internal teams or structure. Examples include:

• Groups that match Azure AD setups
• Product-specific groups
• Role-based groups like Editors, Approvers, and Publishers

By default, every account includes two groups: Everyone and Administrators.

Resource: Manage groups

Groups provide flexibility for managing users, roles, and entitlements. Permissions can be applied at the group level, and any changes automatically apply to all users in the group.

Users can have multiple roles through group membership. A user can belong to multiple groups, each granting different roles and access to different product instances.

The organization’s technical contact or admin creates groups and adds users with the appropriate entitlements. Users receive an email notification to accept their access and create a password.

Once a user accepts their Opti ID invitation and sets a password, they log in via Opti ID. They’ll see the global bar with the product switcher. Logging in with the old application URL redirects them to the homepage in Opti ID. It’s a good idea to update any bookmarked URLS to be: https://login.optimizely.com to avoid the redirects.

Yes. Admins can update instance names via the Admin Center:

1. Go to the Products & Instances tab.
2. Select the product and instance you want to edit.
3. Click Edit and change the Display Name.

Resource: Update product instance name

The technical contact only needs to notify users to log in at https://login.optimizely.com. If Admin Center groups mirror your organization’s internal groups, users can be synced automatically to the correct groups, roles, and instances.

When users log in, their organization’s identity provider (IDP) tells Opti ID which internal groups they belong to. Opti ID then automatically maps these internal groups to the corresponding groups and roles in the Admin Center, so users are assigned the correct permissions without extra setup.

Tip: Make sure your team knows to log in at https://login.optimizely.com.

It depends on whether your organization has migrated to Opti ID.

• If your organization has migrated to Opti ID: Roles and permissions are managed centrally through the Admin Center. You can create custom roles to fit your team’s needs.
• If your organization has not yet migrated or a given product you’re using isn’t yet migrated: Roles and permissions remain managed within your individual Optimizely application.

Additional info:

• System roles are prepackaged by Optimizely and cannot be edited. These roles provide a foundation for building your entitlements.
• You can create custom roles in the Admin Center to tailor permissions for your team.

For step-by-step guidance, see: Roles and permissions