ThousandEyes Documentation
  • ThousandEyes Documentation
  • What's New
    • Changelog
    • Naming and Navigation Menu Changes - Summary List
  • Product Documentation
    • Getting Started
      • Getting Started with Account Setup
      • Getting Started with Cloud and Enterprise Agents
      • Getting Started with Cloud and Enterprise Agent Tests
      • Getting Started with Endpoint Agents
      • Getting Started with Transactions
      • Getting Started with Dashboards
      • Getting Started with Alerts
      • Getting Started with Internet Insights
      • Getting Started with the ThousandEyes API
      • Getting Started with API Tests
      • Getting Support from ThousandEyes
      • Notification of Upgrades, Maintenance and Outages
      • New User FAQ
      • ThousandEyes Glossary
    • Global Vantage Points
      • Cloud Agents
        • Where Are Cloud Agents Available?
        • Webex Cloud Agents
        • AWS Wavelength Cloud Agents
        • Cloud Agent with Local Problems
      • Enterprise Agents
        • Getting Started
          • Where Can I Get the Account Group Token?
        • Installing
          • Enterprise Agent System Requirements
            • Enterprise Agent Support Lifecycle
          • Appliances
            • How to Set Up the Virtual Appliance
            • Enterprise Agents: Hypervisor Installation
            • Installing Enterprise Agent on VirtualBox
            • Enterprise Agent Deployment Using ThousandEyes Virtual Appliance (Hyper-V)
            • Enterprise Agent Deployment Using ThousandEyes Virtual Appliance (OVA)
            • Custom Virtual Appliances
            • Installing a Physical Appliance
            • Installing an Enterprise Agent on a Raspberry Pi Device
          • Cisco Devices
            • Catalyst Switching
            • Catalyst Routing
            • Nexus Switching
            • Service Routing
            • Meraki MX Appliances
            • Cisco Enterprise NFV Infrastructure Software
            • Installation Methods
              • Installing Enterprise Agents on Cisco Nexus Switches with Application Hosting
              • Installing Enterprise Agents on Cisco Nexus Switches with Guestshell
              • Installing Enterprise Agents on Cisco Routers using SD-WAN Manager Feature Templates
              • Installing Enterprise Agents on Cisco Routers using the SD-WAN Manager ThousandEyes Workflow
              • Installing Enterprise Agents on Cisco Switches with Docker
              • Installing Enterprise Agents on Cisco Routers with Docker
              • Installing Enterprise Agents on Cisco Switches with the DNA Center
          • Linux Packages
            • Enterprise Agent Deployment Using Linux Package Method
            • Installing the Enterprise Agent with BrowserBot on Oracle Linux Server 7
          • Docker Agents
            • Installing Enterprise Agents with Docker
          • Cloud Templates
            • Installing Enterprise Agents with Microsoft Azure
          • Docker Agent Configuration Options
          • Missing Dependencies for Enterprise Agent on Redhat Enterprise Linux RHEL 7 Installation
          • Migrating ThousandEyes Appliance or Package-Based Enterprise Agent to Docker
        • Configuring
          • Password Reset on the Virtual Appliance
          • Configuring rDNS Lookups for Enterprise Agents
          • Connecting to the ThousandEyes Virtual Appliance Using SSH (Mac/Linux)
          • Connecting to the ThousandEyes Virtual Appliance Using SSH (Windows)
          • Static IP Addresses for ThousandEyes Repositories
          • Firewall Configuration for Enterprise Agents
          • Enterprise Agent Port Forwarding
          • Security Policy and Public NTP Servers on Enterprise Agents
          • Secure Access to ThousandEyes Appliances
          • Disabling the Web Server of a Virtual Appliance
          • NAT Traversal for Agent-to-Agent Tests
          • Enterprise Agent on Docker Advanced Networking
        • Managing
          • Cisco Devices
            • Disable, Restart, or Uninstall the Enterprise Agent via DCNM
          • Docker Agents
            • Add/Remove BrowserBot from Existing Docker Enterprise Agents
          • Upgrading Operating Systems for Enterprise Agents
          • Backup and Restore Your Enterprise Agent Configuration
          • Upgrade Ubuntu 20.04 Focal-Based ThousandEyes Appliances
          • Crash Reporting for Enterprise Agents
          • Configuring a Local Mirror of the ThousandEyes Package Repository
          • Resetting an Enterprise Agent
          • Working with Enterprise Agent Clusters
          • Replacing an Enterprise Agent Using the Agent Clustering Method
          • Replacing an Enterprise Agent Using Agent Identity Files
          • Unlocking the ThousandEyes Appliance
          • Uninstalling the Enterprise Agent (Linux Package)
        • Proxy Environments
          • Installing Enterprise Agents in Proxy Environments
          • Configuring an Enterprise Agent to Use a Proxy Server
          • Writing and Testing Proxy Auto-Configuration (PAC) Files
        • Troubleshooting
          • How to Generate Packet Captures
          • Troubleshooting Automatic-Update Problems on Enterprise Agents
          • Troubleshooting Time Synchronization on Enterprise Agents
          • Installing CA Certificates on Enterprise Agents
          • Agent Unable to Trace Path to Destination?
          • BrowserBot Installation Fails on Red Hat or CentOS in Amazon EC2
          • What to Do If te-agent Stops Running Due to a VACUUM Error
        • Enterprise Agents: What Information Do We Collect?
        • What Is BrowserBot?
        • Upgrading to BrowserBot 2
        • Upgrading to BrowserBot 2.6+ (Chromium 97)
        • Enterprise Agent Utilization
        • Network Utilization from Enterprise Agent Test Traffic
        • Enterprise Agent Interface Selection
        • ThousandEyes Product Lifecycle Policy
      • Endpoint Agents
        • Installing
          • System Requirements
          • Download the Endpoint Agent Installer
          • Install the Endpoint Agent
          • Reinstall the Endpoint Agent
          • Install the Endpoint Agent Browser Extension
          • Install Endpoint Agents for Windows via Group Policy
          • Installing Browser Extensions for Windows via Group Policy
          • Guidance for Windows Software Deployment Teams
          • Install Endpoint Agents for macOS using Munki and the Managed Software Center
          • Deploy an MSI package to Intune for Windows Devices
          • Endpoint Agent Installation on Cisco Webex Devices (RoomOS)
          • Endpoint Agent Installation on Cisco Phone Devices (PhoneOS)
          • Uninstall or Delete an Endpoint Agent
          • Endpoint Agent Installation Reference
          • NPCAP Driver Upgrade Management
        • Configuring
          • Configure Endpoint Agent Labels
          • Endpoint Agent Proxy Configuration for Scheduled Tests
        • Managing
          • Manage Endpoint Agent Settings
        • How Does the Endpoint Agent Work
        • Cisco Secure Client ThousandEyes Endpoint Agent Module
        • Endpoint Agent Licensing
        • Assigning tests to an Endpoint Agent
        • Data Collected by Endpoint Agent
        • Reporting on data collected by Endpoint Agent
        • Endpoint Agent VPN Support
        • Endpoint Agent TCP Support
        • Endpoint Agent End-user Experience
        • Endpoint Agent FAQ
      • Working with Agent Settings
      • Obtaining a list of ThousandEyes Agent IP Addresses with te-iplist
    • Tests
      • HTTP Server Tests
        • Collecting Proxy Metrics
        • POSIX Extended Regular Expression Syntax (Quick Reference)
        • POSIX Extended Regular Expression Syntax
        • Custom User-Agent Strings in a Web Test
        • Two-Step HTTP Testing (OAuth)
      • Web-Layer Tests
      • Network Tests
        • Network Tests Explained
        • Agent-to-Agent Test Overview
        • DSCP Options in Network Tests
      • DNS Tests
      • Voice Tests
        • Using the SIP Server View
        • Using the RTP Stream View
      • BGP Tests
        • Inside-Out BGP Visibility
        • Using the BGP Route Visualization View
        • Using the BGP Updates Table
        • Working with Raw BGP Data
        • Reasons for Failure of Private Peering with ThousandEyes
        • RPKI
      • API Tests
        • Using the API Test Step Builder
      • Templates
        • User-defined Templates
      • Recommendations
        • Associated Service Recommendations
        • AWS Test Recommendations
      • ThousandEyes Metrics: What Do Your Results Mean?
      • Sharing Test Data
      • Working with Test Settings
      • Scheduled Versus Instant Tests
      • Working with Instant Tests
      • Working with Labels for Agent and Test Groups
      • Multi-Service Views
      • Identifying Traffic from ThousandEyes Agents
      • Excluding ThousandEyes Agents from Google Analytics
    • Internet and WAN Monitoring
      • Path Visualization
        • How Path Trace Works
        • MPLS Tunnel Inference Using Deep Path Analysis
        • Troubleshooting
          • Reasons for Missing Information on the Visualization View
          • Virtual Machine with NAT Breaks Path Visualization
          • Cisco ASA Breaks Path Visualization
          • Path Visualization: Edge Firewall Incorrectly Shows a Single Hop to the Destination
          • Network Overview Shows Packet Loss That Does Not Appear in Path Visualization
      • Views
        • Using the Network Overview
        • Using the FTP Server View
        • Using the HTTP Server View
        • Using the DNS Server View
        • Using the DNS Domain Trace View
        • Using the DNSSEC Trace View
        • Using the API Test Views
      • Troubleshooting
        • CLI Network Troubleshooting Utilities
        • HTTP Server Test Fails with SSL Error
        • HTTP Server Test Fails with SSL Error: OpenSSL SSL_connect: SSL_ERROR_SYSCALL
        • HTTP Server Test Error "dh Key Too Small"
    • Browser Synthetics
      • Browser Synthetics Test Types
      • Browser Synthetics Disambiguation
      • Test Settings for Page Load and Transaction Tests
      • Navigating Waterfall Charts for Page Load and Transaction Tests
      • Using Round Robin Test Scheduling
      • What Information Is Transmitted in a Page Load or Transaction Test?
      • Transaction Test SSO Support
        • Implementing SSO in Transaction Scripts
        • Caveats for NTLM/Kerberos Authentication
        • TOTP Examples for SSO
      • Page Load Tests
        • When to Use a Page Load Test
        • Creating a Page Load Test
        • Using the Page Load View
        • How to Generate a HAR File
        • Migrating to Single Interval for Page Load Tests
        • Creating a Page Load Test that Uses SSO
      • Transaction Tests
        • Getting Started With Transaction Tests
          • When to Use a Transaction Test
          • Transaction Tests Compared With Other Test Types
          • ThousandEyes Recorder
          • ThousandEyes Recorder Permissions
          • Working With Web Development Tools
          • Working With Secure Credentials
          • Transaction Test Table Tab View
          • Transaction Metrics on Alerts and Dashboards
          • Screenshots in Transaction Test Views
        • Transaction Test Development Guide
          • Creating Robust Transaction Scripts
            • Optimizing and Troubleshooting Transaction Scripts
            • Transaction Scripting Tips and Tricks
          • Transactions – Executing Custom JavaScript Code
        • Use Cases | Code Examples
          • Uploading or Downloading Files in a Script
            • Transaction Scripting Examples for File Downloads
          • Include API Calls in a Transaction Test
            • Using the node-fetch module
            • Using the net module
            • Using the tls module
        • Transaction Scripting Reference
      • Dual Chromium Option
        • Why Are Regular Chromium Upgrades Needed?
        • Configuring Dual Chromium
        • Working With Dual Chromium
        • Chromium Update History
        • Chromium Upgrade Known Issues
    • Endpoint Experience
      • Test Settings
        • Monitoring an Application using Synthetic Tests
        • Configuration Options for Synthetic Tests
        • Managing Synthetic Tests
        • Real User Tests
      • Viewing Data
        • Endpoint Agent Scheduled Tests View
        • Endpoint Agent Real User Tests View
        • Endpoint Agent Local Networks View
        • Endpoint Agent Dynamic Tests View
        • Endpoint Agent Views
        • Endpoint Views Reference
      • Troubleshooting
        • Step-by-Step Guide to Troubleshooting Endpoint Agent Problems
        • Troubleshooting Endpoint Agent Issues
    • Connected Devices
      • Connected Devices Tests
        • Routing
          • Traceroute
        • Network
          • Speed Tests
          • Latency, Loss, Disconnections, and Jitter Tests
          • Responsiveness (Latency under Load) Tests
        • DNS
          • DNS Resolution Tests
        • Web
          • Web Browsing Lite Tests
          • Generic Streaming (HLS/DASH) Tests
        • Voice
        • Dynamic Application Test Suites
          • Gameplay Test Suite
          • Video Conferencing Test Suite
          • Social Media Test Suite
          • Game Store Test Suite
          • Video Streaming Test Suite
            • Netflix Streaming Tests
            • YouTube Streaming Tests
            • BBC iPlayer Streaming Tests
          • Content Delivery Network (CDN) Test Suite
        • Local Network Information
          • Data Usage
      • Test Management
        • Test Triggers
          • Scheduled Tests
          • Instant Tests
        • Testing Thresholds
        • Test Targets
          • Test Server Methodology
        • Automatic Test Configuration Retrieval
      • Device Agents
        • Router Agents
          • Router Agent Device Support
        • Installing Device Agent with Docker
        • Connected Devices Agent Release Versions
      • Usage Guides
        • Viewing Charts
        • Configuring Charts
        • Using Maps
        • Exporting Data
        • Importing Metadata
        • Managing Metadata
        • Creating Reports
        • Viewing Agents
        • Using Test Schedules
        • Accessing Your APIs
        • Using ConstantCare
      • Cisco Real Speed
    • Cloud Insights
      • Integrations
      • Views
      • Settings
    • Traffic Insights
      • Traffic Insights System Requirements
      • Traffic Insights Configuration Guide
      • Traffic Insights Views and Settings
      • Traffic Insights FPS Monitoring
    • WAN Insights
      • WAN Insights Quick Start
        • How to Activate ThousandEyes WAN Insights
        • WAN Insights Introductory Tour, Part 1
        • WAN Insights Introductory Tour, Part 2
        • WAN Insights Introductory Tour, Part 3
      • Introducing WAN Insights
        • What Is WAN Insights?
        • WAN Insights Value-Add
        • Why Use WAN Insights?
        • Using WAN Insights Together With ThousandEyes Network Assurance
        • Using WAN Insights Together with vAnalytics and vManage
        • WAN Insights Key Components
        • Enabling WAN Insights
        • Getting Support for WAN Insights
      • WAN Insights Terminology and Reference
      • WAN Insights Technical Overview
        • Application Categories
        • Sites, Routers, Paths, and Interfaces
        • Application Traffic Types
        • Estimating User Counts
        • Estimating Throughput
        • Capacity Planning
        • Understanding Quality
        • Life of a Recommendation
        • Understanding Recommendations
        • WAN Insights and ThousandEyes Alerts
      • WAN Insights User Interface
        • Logging In for the First Time
        • WAN Insights Screens and Workflows
        • Recommendations Screen
        • Recommendation Cards, Explained
        • Recommendation Details Modal
        • Endpoint-Pair Quality Comparison
        • Site Details Screen
        • Capacity Planning Screen
        • Capacity Detail Modal
        • Enter or Upload Bandwidth Data
      • Common Tasks
        • Adding Business-Critical Applications to WAN Insights
        • Email Notifications
        • Adding and Managing WAN Insights Users
        • Applying WAN Insights Recommendations
    • Internet Insights
      • Internet Insights Terminology
      • Limited Outage Map
      • Internet Insights Screens
        • Overview Screen
        • Internet Insights Service Views Screen
        • Application Outages
        • Network Outages
        • Catalog Settings Screen
      • Saving and Sharing from Internet Insights
      • Configuring Internet Insights
      • Provider Labels
      • Using Alerts and Dashboards With Internet Insights
        • My Affected Tests
        • Setting Up Alert Rules for Internet Insights
        • Using the Internet Insights Built-In Dashboard
    • Event Detection
    • Alerts
      • Creating and Editing Alert Rules
        • Global and Location Alert Conditions
        • Alert Rule Severity
        • Adaptive Alert Detection
        • Dynamic Baselines
        • Transport Layer Security (TLS) Alerts
        • Alert Rules for Devices
        • Alert Metrics Reference
      • Default Alert Rules
      • Viewing Alerts
      • Alert Clearing
        • Alert Suppression Windows
      • Alert Notifications
      • Standard Notification Methods
        • Alert Notifications via Email
        • Alert Notifications via SMS
        • Classic Webhooks for Alert Notifications
    • Dashboards
      • Using the Dashboard
      • Customizing Your Dashboard
      • Using the Dashboard Templates
      • Dashboard Widgets
      • Embedding Dashboard Widgets in External Web Sites
      • Excluding Periods of Data From a Dashboard
      • Dashboard Sharing and Snapshots
      • Dashboard Labels
      • Troubleshooting with Dashboard Drill Down
      • Tailoring Dashboards with Dashboard Filters
    • Device Layer
      • Discovering Device-Layer Devices
      • Device Discovery Results
      • Using the Device Layer View
    • Account Management
      • User Registration
        • SAML JIT Provisioning
        • ThousandEyes Support for SCIM
          • How to Configure SCIM with Azure Active Directory
          • How to Configure SCIM with Okta
      • Authorization
        • Role-Based Access Control
          • Role-Based Access, Explained
          • Built-In Roles and Permissions
        • Account Groups
          • What is an Account Group?
          • Working with Account Settings
          • Users in Multiple Organizations
          • Changing Ownership of a Test
          • Working with Time Zone Settings
        • OAuth 2.0 with ThousandEyes
          • Integrations with OAuth 2.0
        • Adding a Profile Image with Gravatar
      • Authentication
        • Logging In
        • How to Configure Single Sign-On
      • User Activity
        • Working with the Activity Log
        • ThousandEyes User Session Timeouts and Terminations
        • How Long is my Data Accessible via ThousandEyes?
        • Retaining Data Beyond the 90-Day Limit
        • Multi-Region Cloud Support
      • Usage-Based Billing
        • About Our Consumption Model
          • Device Agent Consumption Model
        • About Units
        • Test Type Layers and Units
        • Setting Quotas
        • Calculating Units
        • FAQs: Usage
      • Customer Security and Privacy Responsibilities
    • Integrations
      • Custom Webhooks
        • Using OAuth 2.0 Authentication for Your Custom Webhook
        • Webhook Variables
      • Custom Webhook Examples
        • Microsoft Teams for Alert Notifications
        • Cisco Webex for Alert Notifications
        • Google Chat for Alert Notifications
        • Event-Driven Ansible for Alert Notifications
        • Splunk Alert Notification
      • Custom-Built Integrations
        • PagerDuty for Alert Notifications
        • ServiceNow for Alert Notifications
          • Incident Management
        • Slack for Alert Notifications
        • AppDynamics for Alert Notifications
        • AppDynamics for Test Recommendations
        • AWS for Test Recommendations
        • AWS for Cloud Insights
          • AWS for Cloud Insights Using CLI
        • Meraki for Data Enrichment
        • Webex Control Hub Integration
        • Microsoft Teams Integration
        • ThousandEyes for OpenTelemetry
          • Configuring ThousandEyes for OpenTelemetry
            • Configuring ThousandEyes for OpenTelemetry Using the API
            • Configuring ThousandEyes for OpenTelemetry Using the UI
          • Configuring ThousandEyes for Splunk Cloud or Enterprise
            • Configuring ThousandEyes for Splunk Cloud or Enterprise using the API
            • Configuring ThousandEyes for Splunk Cloud or Enterprise using the UI
          • ThousandEyes for OpenTelemetry Data Model
            • ThousandEyes for OpenTelemetry Data Model v1
              • OpenTelemetry Collector Data v1 Example
            • ThousandEyes for OpenTelemetry Data Model v2
              • ThousandEyes for OpenTelemetry Data Model v2 - Metrics
                • OpenTelemetry Collector Data v2 Metrics Example
                • ThousandEyes for OpenTelemetry Data Model Metrics - Migration from v1 to v2
              • ThousandEyes for OpenTelemetry Data Model v2 - Traces
                • OpenTelemetry Collector Data v2 Traces Example
          • OpenTelemetry Collector Configuration
          • Automatic Disabling of Failing Streaming Integrations
        • Cisco ThousandEyes App for Splunk
          • Configuration
          • Inputs
          • Dashboards
          • Troubleshooting
        • Distributed Tracing with Splunk Observability APM
    • Best-Practices Guides
      • Choosing the Right Test Protocol for Network & App Synthetics Tests
      • Optimizing SYN vs SACK Probing Methods to Avoid Unexplainable Packet Loss
      • Using Dashboards to Tell a Story
      • Best Practices for Implementing Account Groups
      • Monitoring Microsoft 365
      • Monitoring Microsoft Teams
      • Monitoring Salesforce
      • Monitoring Slack
      • Monitoring Webex Meetings with Endpoint Agents
      • Monitoring Webex Calling
      • Monitoring Webex Meetings with Cloud and Enterprise Agents
      • Monitoring Zoom
    • API
      • Create/Update/Delete Tests Using the ThousandEyes API
      • Obtaining a List of ThousandEyes Agent IP Addresses
      • Writing JSON to API Produces HTTP 406 Response Code
    • Privacy-Related
      • Authorized Subprocessors for ThousandEyes Network Intelligence Platform
    • Archived Documentation
      • Archived - Displaying and Alerting for Unit Consumption
      • Archived - Dependency Tree for ThousandEyes Enterprise Agent Software
      • Archived - Getting Started with ThousandEyes
      • Archived - Sending ThousandEyes Alerts to AppDynamics
      • Archived - ThousandEyes Infrastructure Changes
      • Archived - Using the Transactions (Classic) View
      • Archived - Transaction Test Migration Workflow
      • Archived - Instructions for Mitigating Meltdown and Spectre on Enterprise Agents
      • Archived - Bash (ShellShock) Security Notice
      • Archived - Endpoint Installation using Customized Installers
      • Archived - Configuring Endpoint Agent Setup
      • Archived - Creating Scheduled Tests on Endpoint Agents
      • Archived - Managing the Endpoint Agent
      • Archived - Enterprise Agent Installation on Juniper NFX Routers
      • Archived - Installing and Removing ThousandEyes X Virtual Framebuffer on Enterprise Agents
      • Archived - Permitted Content Types for Page Load Tests
  • Archived Release Notes
    • 2024
      • Release Notes: January 2024
      • Release Notes: February 2024
      • Release Notes: March 2024
      • Release Notes: April 2024
      • Release Notes: May 2024
      • Release Notes: June 2024
      • Release Notes: July 2024
      • Release Notes: August 2024
    • 2023
      • Release Notes: January 2023
      • Release Notes: February 2023
      • Release Notes: March 2023
      • Release Notes: April 2023
      • Release Notes: May 2023
      • Release Notes: June 2023
      • Release Notes: July 2023
      • Release Notes: August 2023
      • Release Notes: September 2023
      • Release Notes: October 2023
      • Release Notes: November 2023
      • Release Notes: December 2023
    • 2022
      • Release Notes: January 2022
      • Release Notes: February 2022
      • Release Notes: March 2022
      • Release Notes: April 2022
      • Release Notes: May 2022
      • Release Notes: June 2022
      • Release Notes: July 2022
      • Release Notes: August 2022
      • Release Notes: September 2022
      • Release Notes: October 2022
      • Release Notes: November 2022
      • Release Notes: December 2022
    • 2021
      • Release Notes: January 2021
      • Release Notes: February 2021
      • Release Notes: March 2021
      • Release Notes: April 2021
      • Release Notes: May 2021
      • Release Notes: June 2021
      • Release Notes: July 2021
      • Release Notes: August 2021
      • Release Notes: September 2021
      • Release Notes: October 2021
      • Release Notes: November 2021
      • Release Notes: December 2021
    • 2020
      • Release Notes: January 2020
      • Release Notes: February 2020
      • Release Notes: March 2020
      • Release Notes: April 2020
      • Release Notes: May 2020
      • Release Notes: June 2020
      • Release Notes: July 2020
      • Release Notes: August 2020
      • Release Notes: September 2020
      • Release Notes: October 2020
      • Release Notes: November 2020
      • Release Notes: December 2020
    • 2019
      • Release Notes: 2019-01-08
      • Release Notes: 2019-02-06
      • Release Notes: 2019-02-20
      • Release Notes: 2019-03-06
      • Release Notes: 2019-03-19
      • Release Notes: 2019-04-02
      • Release Notes: 2019-04-30
      • Release Notes: 2019-05-14
      • Release Notes: 2019-05-30
      • Release Notes: 2019-06-11
      • Release Notes: 2019-07-23
      • Release Notes: 2019-08-06
      • Release Notes: 2019-08-20
      • Release Notes: 2019-09-03
      • Release Notes: 2019-09-17
      • Release Notes: 2019-10-03
      • Release Notes: 2019-10-15
      • Release Notes: 2019-10-29
      • Release Notes: 2019-11-12
      • Release Notes: 2019-11-26
      • Release Notes: 2019-12-10
    • 2018
      • Release Notes: 2018-01-10
      • Release Notes: 2018-01-17
      • Release Notes: 2018-01-31
      • Release Notes: 2018-02-14
      • Release Notes: 2018-03-07
      • Release Notes: 2018-03-14
      • Release Notes: 2018-03-28
      • Release Notes: 2018-04-11
      • Release Notes: 2018-04-25
      • Release Notes: 2018-05-09
      • Release Notes: 2018-05-23
      • Release Notes: 2018-06-06
      • Release Notes: 2018-06-20
      • Release Notes: 2018-07-03
      • Release Notes: 2018-07-18
      • Release Notes: 2018-08-01
      • Release Notes: 2018-08-15
      • Release Notes: 2018-08-29
      • Release Notes: 2018-09-12
      • Release Notes: 2018-09-26
      • Release Notes: 2018-10-10
      • Release Notes: 2018-10-23
      • Release Notes: 2018-11-13
      • Release Notes: 2018-11-27
      • Release Notes: 2018-12-18
    • 2017
      • Release Notes: 2017-01-04
      • Release Notes: 2017-01-18
      • Release Notes: 2017-02-01
      • Release Notes: 2017-02-16
      • Release Notes: 2017-03-02
      • Release Notes: 2017-03-15
      • Release Notes: 2017-03-29
      • Release Notes: 2017-04-12
      • Release Notes: 2017-04-26
      • Release Notes: 2017-05-10
      • Release Notes: 2017-05-24
      • Release Notes: 2017-06-06
      • Release Notes: 2017-06-21
      • Release Notes: 2017-07-07
      • Release Notes: 2017-07-19
      • Release Notes: 2017-08-02
      • Release Notes: 2017-08-16
      • Release Notes: 2017-08-30
      • Release Notes: 2017-09-13
      • Release Notes: 2017-09-27
      • Release Notes: 2017-10-12
      • Release Notes: 2017-10-25
      • Release Notes: 2017-11-08
      • Release Notes: 2017-11-29
      • Release Notes: 2017-12-13
    • 2016
      • Release Notes: 2016-01-06
      • Release Notes: 2016-01-20
      • Release Notes: 2016-02-03
      • Release Notes: 2016-02-17
      • Release Notes: 2016-03-02
      • Release Notes: 2016-03-16
      • Release Notes: 2016-03-30
      • Release Notes: 2016-04-13
      • Release Notes: 2016-04-27
      • Release Notes: 2016-05-11
      • Release Notes: 2016-05-25
      • Release Notes: 2016-06-08
      • Release Notes: 2016-06-22
      • Release Notes: 2016-07-06
      • Release Notes: 2016-07-20
      • Release Notes: 2016-08-03
      • Release Notes: 2016-08-17
      • Release Notes: 2016-08-31
      • Release Notes: 2016-09-14
      • Release Notes: 2016-09-28
      • Release Notes: 2016-10-12
      • Release Notes: 2016-10-26
      • Release Notes: 2016-11-09
      • Release Notes: 2016-11-23
      • Release Notes: 2016-12-07
      • Release Notes: 2016-12-21
    • 2015
      • Release Notes: 2015-01-07
      • Release Notes: 2015-01-21
      • Release Notes: 2015-02-04
      • Release Notes: 2015-02-18
      • Release Notes: 2015-03-04
      • Release Notes: 2015-04-01
      • Release Notes: 2015-04-15
      • Release Notes: 2015-04-29
      • Release Notes: 2015-05-13
      • Release Notes: 2015-05-27
      • Release Notes: 2015-06-10
      • Release Notes: 2015-06-24
      • Release Notes: 2015-07-08
      • Release Notes: 2015-07-22
      • Release Notes: 2015-08-05
      • Release Notes: 2015-08-19
      • Release Notes: 2015-09-16
      • Release Notes: 2015-09-30
      • Release Notes: 2015-10-14
      • Release Notes: 2015-10-28
      • Release Notes: 2015-11-11
      • Release Notes: 2015-12-02
      • Release Notes: 2015-12-16
    • 2014
      • Release Notes: 2014-01-09
      • Release Notes: 2014-01-22
      • Release Notes: 2014-02-05
      • Release Notes: 2014-03-05
      • Release Notes: 2014-03-19
      • Release Notes: 2014-04-09
      • Release Notes: 2014-04-30
      • Release Notes: 2014-06-04
      • Release Notes: 2014-06-11
      • Release Notes: 2014-06-26
      • Release Notes: 2014-07-09
      • Release Notes: 2014-07-23
      • Release Notes: 2014-08-20
      • Release Notes: 2014-09-04
      • Release Notes: 2014-09-17
      • Release Notes: 2014-10-01
      • Release Notes: 2014-10-15
      • Release Notes: 2014-10-29
      • Release Notes: 2014-11-12
    • 2013
      • Release Notes: 2013-01-08
      • Release Notes: 2013-02-27
      • Release Notes: 2013-03-20
      • Release Notes: 2013-04-02
      • Release Notes: 2013-04-17
      • Release Notes: 2013-05-01
      • Release Notes: 2013-05-21
      • Release Notes: 2013-06-11
      • Release Notes: 2013-06-18
      • Release Notes: 2013-07-10
      • Release Notes: 2013-07-24
      • Release Notes: 2013-08-07
      • Release Notes: 2013-09-05
      • Release Notes: 2013-09-18
      • Release Notes: 2013-10-02
      • Release Notes: 2013-10-30
      • Release Notes: 2013-11-13
      • Release Notes: 2013-11-27
    • 2012
      • Release Notes: 2012-03-28
      • Release Notes: 2012-04-11
      • Release Notes: 2012-04-24
      • Release Notes: 2012-05-22
      • Release Notes: 2012-06-05
      • Release Notes: 2012-06-20
      • Release Notes: 2012-08-01
      • Release Notes: 2012-08-28
On this page
  • Prerequisites
  • Identity Provider-Side Setup
  • IdP Configuration Details
  • Key Points in ThousandEyes Assertion Validation
  • ThousandEyes-Side Setup
  • Enabled vs. Forced SSO
  • User Permissions
  • ThousandEyes Configuration Details
  • Testing SSO
  • ThousandEyes SSO Test
  • IdP SSO Test
  • To Return to the Local Login Page
  1. Product Documentation
  2. Account Management
  3. Authentication

How to Configure Single Sign-On

PreviousLogging InNextUser Activity

Last updated 2 months ago

For the security of your cloud-based infrastructure and the convenience of users in your organization, ThousandEyes offers login via single sign-on (SSO). ThousandEyes supports logins that are both service-provider-initiated (i.e., from the ThousandEyes login page) and identity-provider-initiated (i.e., from the customer’s IdP login). ThousandEyes supports -based SSO.

There are two steps to set up single sign-on with any identity provider (IdP):

  1. The , done within your SSO system of choice.

  2. The , which is done within ThousandEyes.

In general, it is better to configure your IdP first, then ThousandEyes, as the ThousandEyes setup usually requires a URL that you create and/or file that you download during IdP configuration.

You can choose to enable SSO, or to force it. Enabling SSO allows your users to choose whether to use local login or SSO. Forced SSO gives you some added confidence that your users are authenticating in a more secure way. See for more information.

Prerequisites

Before configuring, here's what you need:

  • A ThousandEyes account assigned a role with the Edit security & authentication settings permission.

  • An account or subscription to the IdP of your choice.

  • Information (parameter settings) for both service provider and identity provider configurations, as set out in the "Configuration Details" sections for the and for . This information is used in one of three ways:

    • Static configuration: each parameter must be supplied manually, including verification certificate(s).

    • Imported metadata configuration: ThousandEyes will parse a user-supplied metadata XML file and load the parameters.

    • Dynamic configuration: ThousandEyes will parse a metadata file from a provided URL on demand (for each user login).

Note: Not all IdPs offer all three options; some only offer one.

Identity Provider-Side Setup

Log in to your chosen IdP and follow the prompts to configure a new service provider (SP).

Below are links to SP configuration documentation for popular SAML 2.0-based IdPs:

Every IdP will have a different process for setting up SSO on their system. However, the following steps are common among the above IdPs:

  1. Find and select ThousandEyes listed within the IdP’s application/SP directory.

    Some IdPs may require you to manually add the ThousandEyes application.

  2. Download a verification certificate (for static configuration) or metadata file (for imported metadata configuration) to upload to ThousandEyes.

  3. Configure the new SSO for your users.

    This step might happen at any point during IdP configuration, even after you have configured ThousandEyes.

IdP Configuration Details

Alternatively, you can opt for manual configuration of your IdP. The following information lists the characteristics of ThousandEyes as a SAML SP:

  • SAML Assertion NameID (unspecified or emailAddress format): The email address of the user to be authenticated (must be already a registered user in the ThousandEyes platform).

    • If a valid email address (as registered in ThousandEyes) is not found in the NameID field, the assertion will be parsed for additional name claims.

  • Connection details:

    • Request Compression: Yes

    • Assertion: Unsigned

    • Response: Signed

    • Destination: https://app.thousandeyes.com

    • AuthnContextClassRef: PasswordProtectedTransport

    • Audience Restriction: https://app.thousandeyes.com

Note: When using static configuration, the Audience Restriction configured in your identity provider's configuration must exactly match the value set for the Service Provider Issuer field in ThousandEyes. Any mismatch, including a protocol mismatch and trailing slashes (http:// versus https://) will cause the request to be rejected.

Key Points in ThousandEyes Assertion Validation

  • ThousandEyes parses the email (our primary identifier of users) on the SamlResponse created by your IdP. We require that you configure your IdP to supply a registered user's email address in one of the following attributes of the assertion (failure to find a registered email address in any of these attributes will break the SSO process):

    • NameID in the format "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified”

    • NameID in the format "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"

    • Attribute "emailaddress"

    • Attribute "name"

    • Attribute "Email"

  • Make sure that at least one of the uploaded verification certificates corresponds to the private key that signs the SAML assertion.

ThousandEyes-Side Setup

To get SSO working, you'll need the following information from your IdP:

  • Login URL for your SAML provider.

  • Logout URL for your SAML provider (optional).

  • Identity Provider Issuer.

  • Service Provider Issuer.

  • Verification certificate(s).

Enabled vs. Forced SSO

To enable or force SSO:

  1. Go to Manage > Account Settings > Organization Settings > Security and Authentication to view the Set Up Single Sign-On (SSO) Authentication section.

  2. Toggle Enable SSO to on.

    This step allows your users to choose between logging in directly through ThousandEyes and logging in using your SSO.

  3. To force SSO, you must toggle on both Enable SSO and Force SSO. You cannot force SSO without enabling it first.

Once you save changes, all users in all your organization’s account groups must thereafter use SSO to authenticate with the ThousandEyes platform. If you add new users to the platform, they will automatically be asked to log in using SSO only.

If during or after forcing SSO you encounter an error that means you and your users cannot log in using SSO (for example, you save your SSO configuration before the Run Single Sign-On Test has passed), you will need to:

  • Provide us with your email address to verify your identity.

User Permissions

For a user to log in using SSO, they must be assigned a role with the Login via Single Sign-On permission. As another way of restricting users to log in only via SSO, you can remove the Login via ThousandEyes login page permission. This is useful for Managed Service Providers, for example, who may not want to force SSO for all the organizations they manage.

ThousandEyes Configuration Details

  1. Go to Manage > Account Settings > Organization Settings > Security and Authentication.

  2. Turn on the Enable SSO toggle, or for added security toggle on the Force SSO option as well.

For static configuration:

  1. In the Configuration Type field, select Static.

  2. Fill in the fields according to the settings below.

    Field

    Value

    Login Page URL

    Use the URL created or displayed during your IdP configuration

    Logout Page URL

    https://app.thousandeyes.com/login/sso NOTE: The Logout Page URL is optional. If used, the URL should point to the page you wish your users to see when logging out of ThousandEyes.

    Identity Provider Issuer

    Often an EntityID in the form of a URL generated or displayed while setting up the IdP, for example http://www.your-IdP.com/service-provider-key

    Service Provider Issuer

    https://app.thousandeyes.com IMPORTANT: Ensure that the Service Provider Issuer field matches the "service provider entityId" provided when you set up your IdP. Any mismatch, including a protocol mismatch (http:// vs https://) will cause the request to be rejected.

    Verification Certificate

    Use the certificate file downloaded when you set up your IdP

  3. Click Save.

For those customers who work across multiple organizations, you may need to make more than one instance for ThousandEyes in your IdP. To do this, you can define a different EntityID for each instance in your IdP by adding “/[text]” at the end of the EntityID URI. For example, you might add "/organization1" to one instance and "/organization2" to the other; the entire EntityID for the first instance would therefore read "https://www.thousandeyes.com/organization1". This value must match precisely the EntityID value in the ThousandEyes SSO configuration page by overriding the value of the Service Provider Issuer field.

For imported metadata configuration:

  1. In the Configuration Type field, select Metadata File.

  2. Click Import File.

    A new window opens, where you can browse to the metadata file you downloaded from your IdP.

  3. Click Upload configuration file.

    The Configuration section populates with the SSO parameters, including the verification certificate.

  4. Check the Override box for Logout Page URL and clear the field.

For dynamic configuration:

  1. In the Confguration Type field, select Dynamic.

  2. Type in the URL that you created or was displayed during your IdP configuration.

  3. Click Save.

Testing SSO

Once you have configured both your IdP and ThousandEyes, you can test that your settings have worked in both places.

ThousandEyes SSO Test

  1. Go to Manage > Account Settings > Organization Settings in ThousandEyes.

  2. Click Run Single Sign-On Test.

  3. If the SSO is configured properly, you will get a message indicating success in the section below Configuration.

IdP SSO Test

Some IdPs allow you to test the SSO login from the site where you configured your SSO with them. For those that do, log back in to your IdP and follow the prompts to test SSO once both configurations are complete. For those that don’t, or to check SSO login in a live environment:

  1. For customers who have toggled on Enable SSO only:

    Click the Single sign-on link on the login page.

  2. For customers who have toggled on Force SSO:

    The ThousandEyes login page will automatically default to SSO login.

  3. Type in an SSO-enabled email address, and click Log in. This will redirect you to the login page of your IdP.

  4. Type your username and password. You should now be logged in to ThousandEyes.

To Return to the Local Login Page

This will return you to the non-SSO login page.

For static configuration, type in the parameter settings in the relevant fields (see ), and note down any SSO URL and Entity IDs that may be created during this process (they will be used in the SP configuration).

If your IdP supports XML metadata loading, you can use our SP metadata file available at .

ThousandEyes post callback URL:

When using dynamic or imported metadata configurations, make sure you configure your IdP to use as the Audience Restriction.

Recipient:

AssertionConsumerService URL:

See for examples.

In order to successfully set up SSO in ThousandEyes, you must either enable or force SSO for your users. While enabling SSO gives your users more choice about how to log in, forcing SSO is a more consistently secure way to log in, and is recommended by ThousandEyes (see for further explanation).

Raise a support ticket with us. See for help with this process.

For users with , it is not possible to remove the Login via ThousandEyes login page permission. This feature ensures that administrators cannot be prevented from logging in when they have issues with an identity provider.

Log in to ThousandEyes at .

Go to .

For organizations that have enabled but not forced SSO (see ), you can return to the local (ThousandEyes) login page by using this special login URL:

Note: When Forced SSO is toggled on, all users, including Organization Admins, cannot log in locally using the above URL. To break SSO while Forced SSO is on, you must raise a support ticket with us. See .

Duo
Microsoft Azure Active Directory
Microsoft Active Directory Federation Services
PingOne
Okta
Google Workspace
OneLogin
miniOrange
https://app.thousandeyes.com/saml-metadata
https://app.thousandeyes.com/login/sso/acs
https://app.thousandeyes.com
https://app.thousandeyes.com
https://app.thousandeyes.com/login/sso/acs
Customer Security and Privacy Responsibilities
Getting Support from ThousandEyes
management permissions
https://app.thousandeyes.com
https://app.thousandeyes.com
Getting Support from ThousandEyes
SAML (Security Assertion Markup Language) 2.0
IdP configuration
service provider (SP) configuration
Enabled vs. Forced SSO
IdP
ThousandEyes
IdP Configuration Details
ThousandEyes Configuration Details
https://app.thousandeyes.com/login?breakSso
Enabled vs. Forced SSO
General image of SSO configuraton page with enable and forced SSO both toggled on
Only enabled sso toggled on, forced SSO grayed out
Showing static tab selected
Showing metadata tab selected
Showing import file window
Showing populated configuration section
Showing override check boxes
Showing dynamic tab selected
Showing test success
Showing login page with SSO link
Showing SSO-only login page