Intercom - SSO configuration
Valid redirect URIs 
Please note that this application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk.
This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Intercom using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization
To set up Multi-Pass with Intercom, ensure you meet the following requirements:
- Intercom admin rights
- MPAS Admin rights
- Make sure that all users intended to use SSO in Intercom are registered in your IdP and have the necessary permissions to access Intercom.
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.
Intercom - SSO configuration
Step 1 - Configure Multi‑Pass (MPAS) as Identity Provider
Access the Dashboard
- Select your tenant
- In the left-hand menu, click Integrations, then select Applications
- Under Custom Integration, click SAML
Fill the SAML Integration Form Using Intercom Information
| Field | Value |
|---|---|
| SP Entity ID / Audience / Client ID | https://app.intercom.com/saml/<SAML Name> |
| ACS / Assertion Consumer Service URL | https://app.intercom.com/saml/<SAML Name>/consume |
| NameID Policy Format | |
| Name | intercom |
| Description | SSO integration for Intercom |
- At the bottom of the form, download the X.509 certificate, it will be needed in Intercom.
- Click Add Integration to create the app.
Adjust Advanced Settings in MPAS Console
- On the left side, click on advanced console
- Click on Client
- Search for the client you just created, and make sure that all the fields are correctly completed
- General Settings
| Setting | Value |
|---|---|
| Client ID | https://app.intercom.com/saml/<SAML Name> |
| Name | intercom |
| Description | SSO integration |
| Always display in UI | ON |
- Access Settings
| Setting | Value |
|---|---|
| Home URL | https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/clients/<APP_NAME> |
| Valid Redirect URIs | https://app.intercom.com/saml/<SAML Name>/consume |
| IDP-Initiated SSO URL name | <APP_NAME> |
- SAML Capabilities
| Setting | Value |
|---|---|
| Name ID format | |
| Force Name ID format | OFF |
| Force POST binding | ON |
| Include AuthnStatement | ON |
- Signature & Encryption
| Setting | Value |
|---|---|
| Sign documents | OFF |
| Sign assertions | ON |
Step 2 - Configure Intercom as Service Provider
Enable SAML SSO in Intercom
- Sign in to your Intercom workspace
- Go to Settings → Workspace → Security
- Choose Require SAML SSO as authentication method
- Note the SAML Name (grayed-out field)
Complete the SAML Configuration
| Field | Value |
|---|---|
| Single Sign‑On URL | https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml |
| X.509 Certificate | Paste PEM-formatted cert from MPAS |
| Allowed Domains | example.com, mycompany.org |
- Click Save. Verify domain ownership if required via DNS TXT record.
Enforce and Test SSO
- Activate Require SAML SSO in Intercom
- Visit the Intercom login page and enter your email
- It should redirect to the MPAS login page
- Upon successful login, access Intercom