Binding an Identity Provider (IdP) To A UniFi Fabric

UniFi supports zero-trust networking (ZTNA) by integrating with Identity Providers such as Microsoft Entra (Azure AD), Google Workspace, and LDAP-based directories through UniFi Fabrics. This allows organizations to centrally manage identity, authentication, and access across UniFi services including WiFi, VPN, and Door Access.

Requirements

• A Fabric with Consolidated People Management enabled. For more information, see Getting Started with UniFi Fabrics.
• One of the following consoles within the Fabric: UDM Pro, UDM SE, UDM Pro Max, UDM Beast, EFG, EF Core, UNVR Pro, ENVR, ENVR Core. 

Available Identity Providers (Detailed Guides)

• Microsoft Entra (Azure AD)
• Google Workspace
• Active Directory
• LDAP
• JumpCloud LDAP

Binding an Identity Provider (Overview)

To bind an Identity Provider:

1. Go to Site Manager.
2. Select a Fabric.
3. Navigate to Settings > Identity.
4. Enable Consolidated People Management and wait for the Identity Sync Service to set up.
5. Select an Identity Provider and follow the on-screen configuration steps. 
6. (Optional) Enable Enforce IdP Authentication. This enforces SAML authentication for anyone signing in to Site Manager and other ui.com domains globally, not just to this Fabric. 
   Note: This is only available for cloud IdPs like Microsoft Entra or Google Workspace, and can only be done once per email domain.
7. Optionally configure UniFi Endpoint Services to streamline how people interact with UniFi services such as WiFi, VPN, and Access Control.

In addition to the security benefits of SAML SSO authentication, the Identity Provider uses SCIM protocol to sync users in realtime, facilitating automated employee onboarding and off-boarding.

Identity Sync Service

The Identity Sync Service is the core identity orchestrator responsible for syncing people and groups from your Identity Provider into the Fabric using SCIM (a standard protocol for syncing accounts and group membership from an IdP), keeping onboarding and off-boarding automated. It also serves as the SAML authentication broker to the IdP for users signing in to UniFi Endpoint to access services such as one-click WiFi, VPN, and Door Access. 

Cloud IdPs can additionally enforce SAML single sign-on for admin sign-in to Site Manager itself, in which case authentication will be brokered by Ubiquiti's Account portal directly, rather than by the Identity Sync Service inside your Fabric.

Impact on Existing People

All users and admins present before the IdP integration will be retained after the integration. Those people will also retain their same permissions and credentials (e.g., Touch Pass and NFC cards for UniFi Access).

Multi-Tenant Management and MSP Accounts

If you’re binding an IdP as a managed service provider across many customer Fabrics, see Multi-Tenant Customer Management With an MSP Account. The same binding flow applies one level up, at the MSP Account level.

Next Steps

After binding an Identity Provider:

• Configuring UniFi UniFi Endpoint Services for Secure Zero-Trust Network Permissions
• Create Roles & Assign People Permissions