Alibaba Cloud supports role-based SSO and user-based SSO. Choose the method that fits your identity infrastructure and access requirements.
Use cases of role-based SSO
Avoid creating or managing users in Alibaba Cloud — role-based SSO lets you control access entirely through your identity provider (IdP), with no user synchronization required and lower operational costs.
Use SSO as the primary logon method while keeping a small set of native RAM users as a fallback. These accounts provide a backup logon path if your IdP or network becomes unavailable, and can also be used to test new cloud features.
Centralize permission management in your IdP. Map IdP user groups or attributes to RAM users, then grant or revoke access by updating group membership or attributes — no changes needed on the Alibaba Cloud side.
Connect multiple Alibaba Cloud accounts to a single IdP. Configure your IdP once and extend SSO to all accounts without repeating the setup.
Connect multiple IdPs to a single Alibaba Cloud account. Register each IdP in the account to support SSO from all of them simultaneously.
Support both console access and programmatic access (API calls) for your users.
Use cases of user-based SSO
Require Service Provider (SP)-initiated SSO, where users start the logon process from the Alibaba Cloud console logon page rather than from your IdP portal.
Access Alibaba Cloud services that do not support RAM roles (that is, access through Security Token Service (STS)). For the list of services that support RAM role access, see Services that work with STS.
Work with an IdP that does not support complex attribute configuration.
Keep your IdP configuration simple — user-based SSO requires less setup than role-based SSO and covers most standard access scenarios.