Login Management for Administrators

As an administrator, you're responsible for configuring and maintaining secure access to NiCE CXone applications. This includes:

  • Managing authentication methods
  • Configuring login authenticators
  • Integrating external identity providers (IdPs)
  • Designing password and multi-factor authentication (MFA) policies
  • Assigning authorization through roles and permissions.

Authentication and Authorization

When a user logs in to the NiCE CXone platform, the system performs two separate processes:

  • Authentication verifies the identity of the user.
  • Authorization determines which applications, features, and data the authenticated user can access.

The system must successfully complete both processes for a user before they can access the platform or its applications. NiCE CXone supports authentication through either the built-in identity provider or an external identity provider (IdP). Authorization is always managed internally within NiCE CXone through roles, permissions, and other data access configurations. External authorization systems are not supported.

Login Flow

The standard login process follows these steps:

  1. The user accesses the NiCE CXone platform through a login URL.
  2. NiCE CXone requests login credentials.
  3. The user enters credentials or is redirected to an external IdP.
  4. The internal or external identity provider validates the credentials.
  5. NiCE CXone authorizes the user based on the permissions in the role assigned to the logged-in user account.

The authentication method used does not affect authorization. All users are authorized through NiCE CXone security profiles and role assignments.

Login When Multi-Region Business Continuity Plan (Business Continuity Plan) is Enabled

Multi-Region Business Continuity Plan (Business Continuity Plan) (Multi-Region BCP) provides a secondary NiCE CXone system that can be used in the event of any disruption to the primary system's ability to run. This includes outages, planned maintenance, or regional failures.

When Multi-Region BCP is enabled, users are automatically redirected to the secondary system without disruption. The login process is unaffected unless the user has more than one account in the system. If a user has multiple accounts, the system prompts them to choose the account they want to use to log in. A separate URL is not required to log in to the Multi-Region BCP system.

Authentication Types

NiCE CXone supports the following models of authentication: 

  • Internal or system authentication: User names and passwords are managed in NiCE CXone.
  • External authentication: User identities are managed and authenticated by an external Identity Provider (IdP).

Internal Authentication

Internal authentication uses the built-in NiCE CXone identity provider. Users authenticate with a username and password managed directly in the platform. You can configure authentication options in login authenticators: 

  • Password complexity requirements
  • Password expiration policies
  • Password history restrictions
  • Maximum failed login attempts
  • Account lockout behavior
  • Multi-factor authentication (MFA)
  • Location-based login restrictions

The default login authenticator, System Default, uses internal authentication. You can modify the default login authenticator or create additional authenticators for different user groups.

When using internal authentication, you should define password and security policies that align with your organizational standards.

External Authentication (Single Sign-On)

External authentication delegates user authentication to a third-party identity provider (IdP). This means that user identifies and passwords are managed outside of NiCE CXone. NiCE CXone supports two SAML 2.0 and OpenID Connect (OIDC).

This configuration allows you to implement Single Sign-On (SSO) and centralize credential management in systems such as:

  • Microsoft Entra ID (Azure AD)
  • Okta
  • SecureAuth
  • Other standards-compliant identity providers

When using external authentication, you may need to coordinate with your organization's identity management administrators. Before configuration:

  • Identify the identity provider.
  • Select the federation protocol.
  • Determine whether SP-initiated or IdP-initiated login flows are required.

Login Authenticators

Login authenticators define how users authenticate to NiCE CXone. Every employee profile must be assigned login authenticator before the user can log in.

You can create multiple authenticators to support different login requirements across the organization. For example you might want different login requirements for: 

  • Internal employees using SSO
  • Contractors using local authentication.
  • Administrators requiring MFA.
  • Users restricted to specific IP ranges.

  • Validate compatibility with CXone applications.

Each user can only have one login authenticator assigned at a time.

Multi-Factor Authentication (MFA)

You can require MFA for users authenticated through the built-in identity provider. MFA adds an additional verification step during login and improves account security. You can configure it in login authenticators.

For external authentication, MFA is typically enforced by the external identity provider.

Application and API Authentication

NiCE CXone supports authentication for integrations and application users. Application users are applications such as virtual agents, bots or other integrations that need access to the platform.

Application users do not use passwords to authenticate. Instead, they: 

  • Use built-in authentication only
  • Do not use login authenticators
  • Authenticate using OAuth or access keys depending on the integration type

NiCE CXone APIs support OAuth 2.0 authentication and OpenID Connect standards. Access tokens are required for API access.

Troubleshoot Login Issues

Authentication failures are commonly caused by:

  • Incorrect or missing login authenticator assignment
  • Invalid IdP configuration
  • Incorrect certificates
  • Mismatched External Identity values
  • Expired passwords
  • IP restriction conflicts
  • Unsupported login flows

When troubleshooting:

  1. Verify the user's assigned login authenticator.
  2. Validate IdP configuration values.
  3. Confirm certificates are current.
  4. Verify the user's External Identity mapping.
  5. Test authentication with a known working user account.

Authentication configuration errors typically prevent all affected users from logging in until corrected.

Security Best Practices for Login Processes

NiCE recommends the following best practices for login processes:

  • Use SSO with a trusted enterprise identity provider.
  • Require MFA for privileged accounts.
  • Restrict administrative logins by IP range.
  • Regularly review roles and permissions.
  • Use separate login authenticators for different user populations.
  • Test authentication changes before production rollout.
  • Maintain at least one emergency administrative account with local authentication.
  • Plan carefully and carry out staged testing to minimize authentication disruptions during implementation or migration projects.