Legacy SSO End of Life (EOL) effective August 31, 2026

As part of our ongoing efforts to improve security and user management, we are retiring Legacy SSO and transitioning customers to SSO 2.0 with SCIM. In addition, SSO 2.0 offers enhanced scalability, functionality, and efficiency, while providing full control over user management and configuration.

We recognize that transitioning to a new system requires coordination, and we're committed to making this process as smooth as possible. Because you performed reconciliation during the Legacy SSO process, the reconciliation steps for SSO 2.0 is expedited. If you have questions regarding the transition process, please reach out to your account manager or Technical Support for more information.

Before August 31, 2026

Customers who use Legacy SSO need to migrate to SSO 2.0 to take advantage of improved security and functionality.

After August 31, 2026

Legacy SSO will move to End of Life status, and users won't be able to authenticate using their company’s identity provider credentials when their client secret expires.

Bluebeam officially supports SSO configuration for the following IdPs:

• Microsoft Entra ID: If you use Microsoft Entra ID as an IdP, see Configuring SSO for Bluebeam Accounts | Entra ID.

• Okta Workforce Identity Cloud: If you use Okta Workforce Identity Cloud as an IdP, see Configuring SSO for Bluebeam Accounts | Okta Workforce Cloud.

Revu is compatible with other IdPs that use OpenID Connect (OIDC) as an authentication protocol, but those configurations aren't supported, and SCIM enablement isn't available. Bluebeam Support won't be able to troubleshoot if you have issues configuring SSO for an unsupported IdP, and you may need to disable SSO.

The ability to configure SSO is only available if your organization:

• Has purchased or converted a minimum of 10 seats to a Bluebeam subscription plan.
• Is not already configured to use SSO with Bluebeam products and services. If your organization already has SSO configured, contact us before continuing.
• Uses Microsoft Entra ID or Okta Workforce Identity Cloud as an identity provider (IdP).
  

Other IdPs are compatible but not supported. For more information, click here.

Only users with the IT Admin role in Org Admin and the Tenant Admin role on the tenant can configure SSO and SCIM. The Org Admin who requests SSO will automatically be made an IT/Tenant Admin.

• Minimum seats: 10

• Maximum domains: 500 per SSO configuration

• SSO support level: Parent account (but inherited by child accounts)

• SCIM support:

  • Parent account only

  • Users must all be under one account

  • Users must all be using the same license region

• Multi-tenant: Not supported (separate parent accounts required)

• Child account SCIM: Not supported

Before we remove the IdP for all regions, we need the following information:

• From which region should your subscriptions be managed? Please consider the following:

  • The region should align with the primary region from which your company operates.

  • If your end users work from a different server region from where your company operates, you may want to select that region.

  • When you create a tenant with a region, you cannot change the region later.

• Will any members need to switch to a different Studio server after this transition? Please note the following:

  • The subscription region and Studio region should be independent if users require access to a different Studio server.

  • By default, Revu signs users into Studio using their license credentials, but they must disable this default and select the correct Studio region manually.

No. Bluebeam doesn't currently support multiple tenant configurations under a single organization.

If you need independently managed SSO and SCIM for different business units or subsidiaries, the following applies:

• You must split those tenants into separate parent accounts with separate Org Admin accounts.

• Each parent account would have its own SSO and SCIM configuration.

No. Each organization manages its own SSO and SCIM setup through the parent account. Child accounts inherit configurations from the parent account configuration.

If you need separate SSO and SCIM configurations for child accounts, you must restructure your accounts so each child company becomes a parent account with a separate Org Admin account.