An SSO setup isn’t “set and forget”: certain events in your organization’s lifecycle require coordinated action between the customer and Cyber Guru. Planning ahead helps prevent user access issues.
| 🛑 | General rule: after setup, metadata should be considered fixed. Don’t modify them or recreate the application on your own. Any changes—new certificate, new application, different endpoints, or switching Identity Provider—must be managed by opening a request with Cyber Guru support, who will coordinate updates on both sides. |
1. Renewing the SAML Signing Certificate
The certificate your Identity Provider uses to sign assertions has an expiration date (typically 1-3 years). When it expires, if the new certificate hasn’t been shared with Cyber Guru, all SSO access will stop working.
Who gets the notification
Expiration notifications sent by Microsoft Entra ID refer to the certificate for your application, meaning on your side. The Cyber Guru Service Provider certificate has a much longer expiration and is managed by Cyber Guru.
Before making any changes
| ⚠️ | Don’t activate the new certificate before agreeing on a switch window with Cyber Guru. In Entra ID, you can create a new certificate and leave it inactive: create it, share it, and only activate it once Cyber Guru confirms their configuration has been updated. |
Procedure
- Notify Cyber Guru a few weeks in advance, providing the expiration date of the current certificate and your company name.
-
Generate the new certificate on your IdP without activating it:
- Microsoft Entra ID: SAML page of the app → SAML Certificates panel → Edit → New Certificate. Leave it Inactive.
- Google Workspace: Apps → Web and mobile apps → Settings → SAML certificates.
- Send Cyber Guru the updated IdP metadata URL (Entra ID: App Federation Metadata Url) or the certificate in PEM format. PEM format is required: if you have a file in another format, let them know.
- Agree on the switch window. Cyber Guru will update their configuration and confirm when you can activate the new certificate on your IdP.
- Activate the certificate and immediately test access with a test user in an incognito window.
Do you need to redo the entire configuration?
It depends:
- If only the certificate changes and the endpoints stay the same, the update is quick and you only need to share the new certificate.
- If the Entity ID or endpoints of the IdP also change—for example, because a new application was created instead of renewing the existing one—the configuration must be redone. That’s why it’s best to renew the certificate on the existing application rather than creating a new one.
| 💡 | If your tenant has multiple Cyber Guru applications (for example, a legacy one and a current one), make sure you know which one is actually in use before proceeding: it’s common to renew the certificate for the wrong app. If you’re unsure, ask Cyber Guru for confirmation. |
2. Changing username, email, UPN, or domain
On first SSO login, the platform creates a permanent link between the IdP identity and the Cyber Guru user account. This link is based on the value of the username attribute.
If that value changes, the platform no longer recognizes the user: access fails with errors like User ... authenticated with identity provider saml does not exist or “Unexpected error during authentication with identity provider”; this requires Cyber Guru technical support to restore the link between identity and user account.
Events that trigger this issue
- Migration of the company email domain (e.g., from
@olddomain.comto@newdomain.com). - UPN changes, even for single users (name change, reorganization).
- Mergers or acquisitions with tenant consolidation.
- Users with different domains within the same company.
| 🛑 | Notify Cyber Guru BEFORE a domain migration or mass UPN change. If planned in advance, the alignment can be done in a scheduled window; if discovered after the fact, it results in blocked users and an emergency fix. |
What to provide to Cyber Guru
- Company subdomain.
- Users involved: list of old and new usernames, or indicate if the change affects the entire user base.
- Planned date for the change on the Identity Provider side.
- If the change also affects the email in addition to the username.
Cyber Guru will perform the alignment and confirm when you can retest. Then, check access with one of the affected users in an incognito window.
How to avoid this issue entirely
Use an immutable attribute as the username: in Microsoft Entra ID, use the Object ID (user.objectid); in Google Workspace, use a stable identifier like the Employee ID. An immutable attribute makes email changes a non-issue: the user stays linked to the same identity, and the email updates if configured to do so. See SSO Identity Provider Attributes.
3. Other changes and their impact
| Change | Impact | Action |
|---|---|---|
| Change in IdP metadata (certificate, endpoints, new application) | Federation breaks if not aligned | Open a support request before making the change |
| Changing the company subdomain | SP URLs change: IdP configuration needs updating | Coordinate the change with Cyber Guru; see Changing a company subdomain |
| Replacing the Identity Provider (e.g., from ADFS to Entra ID) | New full configuration + realignment of existing identities | Notify in advance: this is a project, not a simple change |
| Adding a second tenant or IdP | Additional configuration needed on Cyber Guru’s side | See Advanced SSO scenarios |
| Switching between user preloading modes | No impact on SSO configuration: it’s a flag on the company | Request this from your Cyber Guru contact |
| Switching from pure SSO to hybrid authentication (or vice versa) | Requires updating the user list with the authmode column
|
See Hybrid Authentication |
| Changing the authorized group on the IdP app | Users outside the group lose access (error 403) | No action needed on Cyber Guru’s side, but check group coverage |
| Deactivating a user on the IdP | User can no longer log in, but the account and license remain on the platform | For automatic alignment, SCIM 2.0 is required; if not available, coordinate deprovisioning with Cyber Guru |