Skip to main content

Migrating from Sinch Engage SSO to SinchID SSO: A comprehensive guide

Updated

This guide explains how your organization will migrate from its current Sinch Engage Single Sign-On (SSO) configuration to the new SinchID SSO login experience.

The migration is performed in stages so that your users can continue accessing Sinch Engage while your IT administrator configures and tests the new SSO connection.

The Sinch team will work with your organization throughout the migration.

Overview

Your organization's legacy Sinch Engage SSO will be retired on Feb 1, 2027. Before then, your administrator moves your users to SinchID SSO in five self-service steps. Users keep access throughout.

Why we're making this change: legacy SSO was built for MessageMedia and is being retired as Sinch Engage moves fully onto SinchID, Sinch's identity platform. SinchID gives your users one sign-in for Sinch products at app.sinch.com, with MFA protection and SSO enforced across your whole email domain.

Who should read this: the Sinch Engage admin and the IT administrator who manages your Identity Provider (IdP), such as Microsoft Entra ID, Okta, Ping Identity or Google Workspace.

What changes:

  • Users stop signing in through hub.messagemedia.com. Instead they sign in at https://app.sinch.com and are redirected to your IdP through SinchID.

  • You keep your IdP. You add one new SAML application for SinchID.

  • Your existing SSO application stays in place until the migration is complete.

The five steps

  1. Check prerequisites.

  2. Move yourself to SinchID.

  3. Configure and test SinchID SSO.

  4. Enable Dual Login Mode for everyone else.

  5. Delete the legacy SSO configuration (before Dual Login Mode expires).

Plan for steps 2–5 to take a few days. Hands-on configuration is about 30 minutes; DNS verification and user testing take longer.

Key terms

Term

Meaning

Legacy SSO

Your current SSO connection to Sinch Engage, which signs users in through hub.messagemedia.com

SinchID SSO

The new SSO connection, managed at https://my.sinch.com

Dual Login Mode

A per-user setting that moves the user to SinchID and lets them sign in through either SSO for 14 days

Migration page

Account Settings > Security > Prepare dual login mode for users

Legacy SSO

Your current SSO connection to Sinch Engage, which signs users in through hub.messagemedia.com

Step 1 — Check prerequisites

You can start once all of these are true:

  • You are an admin on the parent account that holds your legacy SSO configuration.

  • Your own email address is on one of your SSO domains (e.g. you@yourcompany.com).

  • Multi-factor authentication (MFA) is enabled for the account. You can turn this on yourself in Account Settings > Security.

  • Your IT administrator can create a SAML application in your IdP and add a DNS TXT record for each SSO domain.

  • You have saved the legacy SSO login URL as a fallback: https://hub.messagemedia.com/login/sso?classic=1

Go to Account Settings > Security. If you see Prepare dual login mode for users, you are ready. If you don't, contact Sinch Support and include your Account ID.

Step 2 — Move yourself to SinchID

  1. In Sinch Engage, go to Account Settings > Security and click Configure SinchID SSO.

  2. Dual Login Mode is enabled for your user automatically, and you are taken to the SinchID portal at https://my.sinch.com.

  3. Complete the SinchID sign-in and MFA set-up.

app.sinch.com page

Everyone else keeps signing in through legacy SSO as before. Keep this portal tab open for Step 3.

Step 3 — Configure and test SinchID SSO

Your IT administrator sets up the new connection while everyone else stays on legacy SSO. Full IdP instructions, including Microsoft Entra ID, are in Sinch ID SSO (SAML).

Do not modify or delete your existing SSO application in your IdP. It is your fallback until Step 5.

  1. In the SinchID portal tab from Step 2, open SSO Configuration.

  2. Go to SSO Configuration > Domains, click Connect domain, enter your domain (e.g. yourcompany.com) and click Submit.

  3. Add the TXT record shown to your domain's DNS. Click Check DNS until the status changes from In review to Verified. This can take minutes to hours.

  4. In your IdP, create a new SAML application for SinchID.

  5. In the SinchID portal, click Manage on your domain, then Configure Enterprise SSO. Copy the Entity ID and Callback URL into the new IdP application.

  6. Copy the IdP's sign-in URL and signing certificate (Base64) back into the SinchID portal. Under Advanced settings, enable Sign request and choose HTTP-POST. Save.

  7. Configure these SAML claims in your IdP:

    SinchID field

    SAML attribute

    Microsoft Entra ID source

    Email address

    EmailAddress

    user.mail

    First name

    FirstName

    user.givenname

    Last name

    LastName

    user.surname

    Display name

    NAME

    user.displayname

  8. Assign yourself to the new IdP application.

  9. In the SinchID portal, turn on Enterprise SSO. Leave Username and Password on for now.

Test it

  1. Keep your SinchID portal tab open, so you can fix the configuration if sign-in fails.

  2. In a private browser window, go to https://app.sinch.com and enter your email.

  3. Confirm you are redirected to your IdP, then land in the correct Sinch Engage account with your usual permissions.

  4. In Sinch Engage, open Activity Log and confirm an entry showing you signed in via SinchID with SAML.

If sign-in fails, use the legacy SSO URL from Step 1 and check the claims and certificate.

Tip: The TXT record is used for a one-time ownership verification of your domain during the setup of SSO. Once you have completed this process, you may remove the TXT record if you wish, and SSO will continue to work without it.

Step 4 — Enable Dual Login Mode for everyone else

Once your own test passes, move the rest of your users. Start with a small pilot group, then do everyone.

Before each batch

  • Assign the users (or their groups) to the new SinchID application in your IdP.

  • Check their email addresses in your IdP match their Sinch Engage email addresses.

  • Tell them the login change is coming and where to report problems.

Enable the batch

  1. Open the migration page (Account Settings > Security > Prepare dual login mode for users).

  2. Set the filter to Not ready to see who is left. Select users (Select all works per page).

  3. Click Enable dual login, confirm, and review the results. Retry any failures.

  4. Ask the batch to sign in at https://app.sinch.com. Check the Activity Log for SinchID SAML sign-ins.

Repeat until the Not ready filter is empty — including dormant and disabled users. Anyone left behind can still sign in with a password after legacy SSO is removed.

Why you may see users from other accounts: the migration page lists every user on your SSO domains, including users in your organization's other Sinch Engage accounts and dormant users. SinchID applies SSO to the whole domain, so all of them must be migrated. You can only change their Dual Login Mode; you cannot see or change anything else.

Users invited during the migration may not be moved to SinchID automatically. Re-check the Not ready filter before Step 5 and enable any new users.

Do not use Disable dual login unless you mean to roll a user back. Disabling also removes the user from SinchID.

Step 5 — Delete the legacy SSO configuration

The migration is complete only when you delete the legacy SSO configuration. Do this before Dual Login Mode expires, or users fall back to legacy SSO.

Dual Login Mode lasts 14 days per user. The end date is shown on the migration page. Need more time? Select the users and click Enable dual login again — this extends the period. Do not disable and re-enable.

When you're ready

  1. Confirm the Not ready filter is empty and users are signing in via SinchID (Activity Log).

  2. Save a copy of your legacy SSO settings, in case you need to roll back.

  3. In Account Settings > Security, delete the legacy SSO configuration.

  4. In the SinchID portal, turn off Username and Password so everyone must use SSO. First, make sure at least one SinchID owner uses an email outside your SSO domain, so they can still sign in if SSO breaks.

  5. Remove the old Sinch Engage SSO application from your IdP.

Troubleshooting and FAQ

Problem

What to do

No Prepare dual login mode for users button

Check Step 1. You must be an admin on the parent account, with an email on an SSO domain, and MFA must be on.

Configure SinchID SSO is greyed out

Refresh the page and check Step 1. If it stays greyed out, contact Support.

A user failed to enable

Retry. If it fails again, contact Support with their email.

Users suddenly back on legacy SSO

Dual Login Mode expired. Re-enable them, then delete the legacy configuration (Step 5).

A user's name shows as their email

Check the NAME claim in your IdP (Step 3).

Signed in, but wrong account or permissions

Check the user's email matches in your IdP and Sinch Engage.

A user is missing from the table

They may belong to another Sinch product (vendor). Contact Support.

You're locked out of the SinchID portal

Use the legacy SSO URL, or contact Support.
Do we need a new Identity Provider? No. You add one SAML application to your current IdP.

Will users notice anything before Step 4? No. Only you sign in through SinchID until you enable others.

Are new users provisioned automatically? No. Invite users in Sinch Engage and assign them in your IdP.

What happens on 1 February 2027? Legacy SSO is switched off. Users not on SinchID SSO will not be able to sign in via SSO.

Getting support: contact Sinch Support with the affected email, time of the sign-in attempt, error message or screenshot, your IdP, and whether legacy SSO still works.

Related to

Related articles