> For the complete documentation index, see [llms.txt](https://docs.thousandeyes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thousandeyes.com/product-documentation/user-management/authentication/configure-sso-with-cisco-account/configure-routing-rules.md).

# Configure Routing Rules

Routing rules apply when setting up more than one IdP. They tell ThousandEyes which identity provider to use for each user. Rules are evaluated in list order, and the first rule that matches the user is applied.

There is no secondary evaluation and no automatic fallback to another IdP or to local authentication if a login fails or if an IdP is unreachable. Put the rule you want to take effect for a given user above any broader rule that would otherwise match them.

## Add a Break Glass Routing Rule (Dedicated Local Authentication Only) <a href="#add-a-break-glass-routing-rule-dedicated-local-authentication-only" id="add-a-break-glass-routing-rule-dedicated-local-authentication-only"></a>

{% hint style="warning" %}
Adding a break glass routing rule switches authentication for all users in your ThousandEyes organization to Cisco account. The change takes effect when you click **Add**, even if you haven't configured an external identity provider. If no usable identity provider is configured, users might be locked out. Create this rule only when you're ready to switch your organization's authentication to Cisco account. After this switch, configure all SSO changes in the Cisco Identity portal.
{% endhint %}

A break glass routing rule is a group-based rule that routes designated users, such as administrators, to local Cisco account credentials when it is their first matching rule. ThousandEyes does not redirect these users to an external IdP or offer a choice between SSO and local login.

Before you create the rule, add the administrators who must use local Cisco credentials to the group and confirm that they can log in with those credentials. Place the break glass rule before rules that send these administrators to an external IdP.

1. In ThousandEyes, navigate to **Manage > Account Settings > Organization Settings**.
2. In the **Single Sign-On (SSO)** section, click **Go to admin portal**.
3. (Optional) If you don’t have a group, create a group.
   1. In the Cisco Identity portal, navigate to **Groups** on the left-hand panel.
   2. Click **+ Create a Group**.
   3. Enter a name for your group.
   4. (Optional) Enter a description for your group.
   5. Add group members.

      Click the dropdown and select organization members to add to your group. You can add up to 500 group members.
   6. Click **Create group**.
4. Navigate to **Settings > Manage IdPs**.
5. Under the **Routing Rules** tab, click **+ Add a new routing rule**.
6. Enter a **Rule Name**.
7. Click the **Select a routing type** dropdown and select **Group**.
8. Click the **If these are your groups** dropdown and select your groups.
9. Click the **Then use this identity provider** dropdown and select **Cisco IdP**.
10. Click **Add**.

    ThousandEyes immediately switches all user logins in your organization to the Cisco Identity portal.

## Add a New Routing Rule

1. In ThousandEyes, navigate to **Manage > Account Settings > Organization Settings**.
2. In the **Single Sign-On (SSO)** section, click **Go to admin portal**.
3. In the Cisco Identity portal, click **Settings > Manage IdPs**.

{% hint style="info" %}
When configuring your first IdP, the routing rule is automatically added and is set as the default rule. You can select another IdP to set as the default rule later.
{% endhint %}

4. Under the **Routing Rules** tab, click **+ Add a new routing rule**.
5. Enter the details for a routing rule:

   * **Rule Name**: Enter a name for the routing rule.
   * **Select a routing type**: Click the dropdown and select domain or group.

     If you select **Domain**, your domain must be verified. For more information, see [Verify Your Domains](https://docs.thousandeyes.com/product-documentation/user-management/authentication/configure-sso-with-cisco-account/verify-domains).
   * **If these are your domains/groups**: Click the dropdown and select domains/groups within your organization.
   * **Then use this identity provider**: Click the dropdown and select IdP.

   ![Add a new routing rule form](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-635668e234c00b74e694b43c17688e18c3cc9bdd%2Fconfigure-new-routing-rules.png?alt=media)
6. Click **Add**.
7. Click the `...` icon next to your new routing rule, then click **Activate**.

## Edit a Routing Rule

1. In ThousandEyes, navigate to **Manage > Account Settings > Organization Settings**.
2. In the **Single Sign-On (SSO)** section, click **Go to admin portal**.
3. In the Cisco Identity portal, click **Settings > Manage IdPs**.
4. Under the **Routing Rules** tab, click the `...` icon next to the rule you want to modify and select **Edit routing rule**.

   ![Routing rule edit menu](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-47e42985e3c5ecc32ce574c8af1db2ffd29bd8c7%2Fedit-routing-rules.png?alt=media)
5. Make the desired changes to the routing rule and click **Save**.

## Deactivate or Delete Routing Rules

{% hint style="info" %}
The **Default rule** can’t be deactivated or deleted, but you can modify the routed IdP.
{% endhint %}

1. In ThousandEyes, navigate to **Manage > Account Settings > Organization Settings**.
2. In the **Single Sign-On (SSO)** section, click **Go to admin portal**.
3. In the Cisco Identity portal, click **Settings > Manage IdPs**.
4. Under the **Routing Rules** tab, click the `...` icon next to the rule you want to modify and select **Edit routing rule**.
5. Select one of the following:
   * **Deactivate**: Preserve the routing rule's configuration for future use.
   * **Delete**: Permanently remove the selected rule from the list of routing rules.

{% hint style="info" %}
Make sure you have at least one active routing rule for the IdP. Otherwise, you might run into problems with your SSO login.
{% endhint %}

## Next Steps

[Test Your SSO Setup](https://docs.thousandeyes.com/product-documentation/user-management/authentication/configure-sso-with-cisco-account/test-your-sso-setup)