Configure Identity Provider Routing Rules For Multiple Identity Providers In Okta

Administrators must route users to the correct Identity Provider (IdP) when an organization uses multiple IdPs. To achieve this, Okta allows administrators to configure routing rules that direct users to the appropriate IdP based on their login identifier's Domain List, a Regular Expression (Regex) match, or a unique User Attribute.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Identity Provider (IdP) Routing Rules
• OpenID Connect (OIDC)
• Security Assertion Markup Language (SAML)

How are users routed to the correct Identity Provider when multiple exist?

Administrators can navigate to Security > Identity Providers > Routing Rules in the Okta Admin Console and configure rules using one of the following three matching criteria:

Option 1: Domain List on Login

This is the most common method for routing B2B or multi-tenant users based on their email domain.

1. Add a new routing rule or edit an existing one.

2. Under the AND User matches condition, select Domain List on login from the dropdown.

3. Enter the specific domains (for example, @customerA.com) that should be routed to this IdP.

4. Select the target IdP from the THEN Use this identity provider dropdown and save the rule.

Option 2: Regular Expression (Regex) on Login

Use this method when routing logic requires complex pattern matching against the user's login identifier that cannot be satisfied by a simple domain list.

1. Add a new routing rule or edit an existing one.

2. Under the AND User matches condition, select Regular Expression on login from the dropdown.

3. Enter a valid Regex pattern to capture the intended login identifiers.

4. Select the target IdP from the THEN Use this identity provider dropdown and save the rule.

NOTE: It is outside of Okta Support's scope to assist with the construction, troubleshooting, or validation of custom Regex statements. Administrators are responsible for ensuring their Regex patterns are valid and performant.

Option 3: User Attribute

Use this method when multiple organizations share the same email domain, or when using consumer email addresses, by matching against a custom directory attribute.

1. Create a unique attribute in the Okta user profile (such as CompanyID).

2. Assign a unique value to this attribute for each organization (for example, value1 for the first organization, value2 for the second).

3. Add a new routing rule or edit an existing one.

4. Under the AND User matches condition, select User attribute from the dropdown.

5. Select the unique attribute (CompanyID), choose the matching operator (for example, Equals), and enter the corresponding value (value1).

6. Select the target IdP from the THEN Use this identity provider dropdown and save the rule.

NOTE: Because Okta must read the user's profile to evaluate the custom attribute, Okta must know the user's identity before routing them. For SP-initiated flows, the downstream application must pass the user's identifier in the authentication request (for example, as a login_hint parameter). If not provided, the user will be prompted by the Okta Sign-In Widget to enter their username first before being routed.