This article explains how to configure SAML authentication for Multi-Level Account Management (MLAM) environments in UltraDNS so that authentication can be consistently applied across subaccounts.
Overview
To use the same SAML authentication across multiple subaccounts, the configuration must be applied to a single account where new users are initially created.
Recommended Configuration
It is recommended to create a dedicated subaccount specifically for federation.
This subaccount should not contain any domains and is used only for initial user placement and authentication configuration.
Why a Federation Subaccount Is Recommended
Configuring SAML at the top-level account can result in users having visibility into all subaccounts, which is typically not desired in MLAM environments.
Using a dedicated federation subaccount allows for controlled user placement and avoids unintended access.
How User Assignment Works
New users are initially created in the federation subaccount where SAML authentication is configured.
After authentication is established, users can be moved to the appropriate account, whether that is a top-level account with broader access or a specific subaccount with limited scope.
SAML authentication continues to function after users are moved to a different account.