Change Summary

The metadata file for RAM User SSO (Single Sign-On) will be updated to change the Entity ID and other related fields to 'signin.alibabacloud.com'. This update will be rolled out on a gradual, per-account basis starting from July 13, 2026, with full migration completed by October 30, 2026. Approximately one to two weeks before your account is scheduled for migration, we will send notifications via email and internal messages. If you have any questions after receiving the notification, please feel free to contact us by submitting a support ticket.

（Background: Since January 2026, Alibaba Cloud International has been migrating to the unified domain 'alibabacloud.com'. RAM has accordingly adopted the new sign-in domain 'signin.alibabacloud.com'.）

Change Guidance

• [Retrieve metadata] The metadata endpoint for the RAM Service Provider remains unchanged: https://signin.alibabacloud.com/saml/SpMetadata.xml?tenantID=xxxxxxxxx. You can retrieve this URL from the Alibaba Cloud console or the official documentation.
• [Configuration] For enterprise users who have already configured RAM user SSO: You must manually download the latest metadata file and update your IdP configuration (e.g., Azure AD, Okta, etc.) with the new RAM Service Provider (SP) settings. Once updated, SSO logins will use the new sign-in domain 'signin.alibabacloud.com'. (Reference: SAML configuration for user-based SSO)
• [Automatically retrieve] For IdPs that automatically fetch metadata (e.g., via scheduled metadata URL sync): No manual action is required. The system will automatically retrieve and apply the updated metadata.
• [IdP Security Configuration] If your enterprise IdP has security settings such as access domain whitelists or ACS URL validation, please add the 'alibabacloud.com' domain to the whitelist to ensure that access is not blocked by your security policies.
• [Update bookmarks] After completing the metadata update on your IdP side, no further action is needed in RAM. However, please review and update any saved references to the legacy sign-in URL (signin-intl.aliyun.com) in your bookmarks, internal documentation, or automation scripts to avoid confusion.

⚠️ Note: signin-intl.aliyun.com remains fully accessible during the transition period. This domain upgrade will not cause SSO login failures or any service interruption. If the metadata file is not updated on the IdP side, SSO logins will continue to redirect to 'signin-intl.aliyun.com', where the page will prompt users to manually switch to the new sign-in domain.