Blog posts by Muhammad Talha

Blog posts by Muhammad Talha2026-06-16T12:37:47.0000000Zhttps://world.optimizely.com/blogs/muhammad-talha/ Optimizely World Setting up Opti Id SSO with and without SCIM<span style="font-size: 11.0pt; line-height: 107%; font-family: 'Verdana',sans-serif; mso-fareast-font-family: Calibri; mso-fareast-theme-font: minor-latin; mso-bidi-font-family: Helvetica; mso-ansi-language: #0C00; mso-fareast-language: EN-US; mso-bidi-language: AR-SA;">This blog compiled learnings, when setting up Opti Id for large enterprises using SCIM and its pros and cons when setting up Opti Id without SCIM. <h2>What is Opti ID and why does provisioning matter?</h2> Opti ID is Optimizely's unified identity layer — a single login that spans all Optimizely products including CMS, CMP, and beyond. Once authenticated, users access every product and instance they are entitled to from a single dashboard, without logging in again. But authentication is only part of the story. For large, fluid user populations, the harder challenge is provisioning — how user accounts are created, kept current, and deactivated as people join, change roles, or leave. Opti ID supports two distinct models for this.   <table class="MsoNormalTable" style="width: 901px; border-collapse: collapse; border-image: initial; height: 229px; border: medium none currentcolor;"> <tbody> <tr style="height: 229px;"> <td style="width: 422.344px; border: 1pt solid rgb(216, 221, 232); background: rgb(255, 248, 245); padding: 9pt 10pt; height: 229px;"> APPROACH A SSO without SCIM Users authenticate through your identity provider via SAML or OIDC. Access rights, roles, and group assignments are configured and maintained manually within the Opti ID Admin Centre. Works with any standards-compliant IdP. </td> <td style="width: 422.344px; border-width: 1pt 1pt 1pt medium; border-style: solid solid solid none; border-color: rgb(216, 221, 232) rgb(216, 221, 232) rgb(216, 221, 232) currentcolor; border-image: initial; background: rgb(232, 241, 255); padding: 9pt 10pt; height: 229px;"> APPROACH B SSO with SCIM Authentication is federated via your IdP, and user provisioning is fully automated via the SCIM protocol. Users and groups defined in your IdP are pushed to Opti ID automatically — including creation, updates, and deactivation. Requires Entra ID, Okta, or PingOne. </td> </tr> </tbody> </table>   <h2>▸  APPROACH A</h2> <h2>SSO without SCIM — Setup & Considerations</h2> This approach uses your identity provider purely for authentication. All user management — invitations, group assignments, role changes, and deactivations — is carried out manually inside the Opti ID Admin Centre. Any IdP supporting SAML or OIDC is compatible. <h3>Setup Steps</h3>      1. Designate a technical owner — One person logs into Opti ID first to establish the organisation and handle initial configuration. This person acts as the first Opti ID administrator and delegates access from there.      2. Configure SSO connections in your IdP — Add Opti ID as a SAML or OIDC application in your identity provider. Up to five SSO connections can be configured — useful for separating geographies, business units, or external users under distinct connections.      3. Register your organisational domains — In Opti ID Admin Centre under Settings > SSO/ Domains, register the SSO / DNS domains your internal users authenticate with. This auto-routes users to the correct SSO connection at login.      4. Handle external and partner users via selective local login — Enable selective local login to give partner individuals a standalone Opti ID account (email + password, MFA optional). Internal users continue authenticating via SSO; external users get a local account managed per-user in the Admin Centre. 5. Create groups and assign roles manually — Build a group structure in the Admin Centre reflecting your organisational needs — by region, product, or access tier. Invite users individually, assign them to groups, and those groups determine which product instances and roles each user can access. <table class="MsoNormalTable" style="width: 1121px; border-collapse: collapse; height: 214px; border-image: initial; border: medium none currentcolor;"> <tbody> <tr style="height: 214px;"> <td style="width: 531.688px; border: 1pt solid rgb(216, 221, 232); background: rgb(240, 255, 248); padding: 9pt 10pt; height: 214px;"> + ADVANTAGES •    Works with any SAML or OIDC identity provider — no vendor restriction •    Simpler to configure and operate; fewer integrated components •    Partners and external users onboarded via local login without changes to your corporate IdP •    Lower initial setup risk; easier to troubleshoot </td> <td style="width: 533px; border-width: 1pt 1pt 1pt medium; border-style: solid solid solid none; border-color: rgb(216, 221, 232) rgb(216, 221, 232) rgb(216, 221, 232) currentcolor; border-image: initial; background: rgb(255, 245, 245); padding: 9pt 10pt; height: 214px;"> − DISADVANTAGES •    No automated offboarding — access must be manually revoked when users leave •    At large scale, individual invitations and role assignments are operationally unsustainable •    Compliance and audit readiness require continuous manual effort •    High risk of orphaned accounts if offboarding processes are not rigorously followed </td> </tr> </tbody> </table>     ▸  APPROACH B <h2>SSO with SCIM — Setup & Considerations</h2> <span style="font-size: 11.0pt; line-height: 107%; font-family: 'Verdana',sans-serif; mso-fareast-font-family: Calibri; mso-fareast-theme-font: minor-latin; mso-bidi-font-family: Helvetica; color: #1a202c; mso-ansi-language: #0C00; mso-fareast-language: EN-US; mso-bidi-language: AR-SA;">SCIM (System for Cross-domain Identity Management) extends your SSO setup by automating the full user lifecycle. Your identity provider becomes the single source of truth — users and groups defined are pushed to Opti ID automatically, including deprovisioning when someone leaves. Officially supported with Microsoft Entra ID, Okta, and PingOne. <h3>Setup Steps</h3>       1. Designate a technical owner and configure SSO — Same starting point as Approach A. Configure your primary SSO connection first — the SCIM configuration option only becomes available after at least one SSO connection is active.       2. Generate a SCIM token in Opti ID — Navigate to Admin Centre > Settings > Authentication > SCIM. Select the SSO connection you want to associate SCIM with and generate the bearer token. This token authenticates your IdP when it pushes user data to Opti ID.       3. Create a SCIM provisioning app in your IdP — Most enterprise IdPs require a separate application for SCIM provisioning, distinct from the SSO app. Configure it using the Opti ID SCIM endpoint URL and token generated above. Some IdPs (such as Okta) allow combining SSO and SCIM in a single app — check your provider's documentation. <span style="font-style: normal; font-variant: normal; font-size-adjust: none; font-language-override: normal; font-kerning: auto; font-optical-sizing: auto; font-feature-settings: normal; font-variation-settings: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal;">          4. Design your group structure and push groups from your IdP — Create groups in your IdP corresponding to the access tiers you need — by region, role, or product. Assign users to these groups. When SCIM syncs, those groups and members are automatically created in Opti ID. Future membership changes propagate within minutes.        5. Map groups to product instances and roles in the Admin Centre — SCIM delivers users and group memberships — it does not configure product instance access or role assignments. In the Admin Centre, map each SCIM-synced group to the appropriate instances and permission levels.   <table class="MsoNormalTable" style="width: 1217px; border-collapse: collapse; border-image: initial; border: medium none currentcolor;"> <tbody> <tr style="mso-yfti-irow: 0; mso-yfti-firstrow: yes; mso-yfti-lastrow: yes;"> <td style="width: 580.344px; border: 1pt solid rgb(216, 221, 232); background: rgb(240, 255, 248); padding: 9pt 10pt;"> + ADVANTAGES •    Full user lifecycle automated — joiners, movers, and leavers handled at IdP level without manual Opti ID steps •    Scales to large user populations with no proportional increase in admin overhead •    Access revocation is immediate when a user is removed from an IdP group •    Single source of truth — your IdP directory drives everything; Opti ID stays in sync •    Significantly reduces compliance audit effort — IdP logs are the system of record <span style="font-size: 11.0pt; line-height: 107%; font-family: 'Verdana',sans-serif; mso-fareast-font-family: Calibri; mso-fareast-theme-font: minor-latin; mso-bidi-font-family: Arial; mso-bidi-theme-font: minor-bidi; color: #1a202c; mso-ansi-language: #0C00; mso-fareast-language: EN-US; mso-bidi-language: AR-SA;">•   Eliminates orphaned account risk through automated deprovisioning </td> <td style="width: 580.344px; border-width: 1pt 1pt 1pt medium; border-style: solid solid solid none; border-color: rgb(216, 221, 232) rgb(216, 221, 232) rgb(216, 221, 232) currentcolor; border-image: initial; background: rgb(255, 245, 245); padding: 9pt 10pt;"> − DISADVANTAGES •    Only officially supported with Entra ID, Okta, and PingOne •    SCIM is restricted to one SSO connection — separate IdP tenants per region means only one gets full automation •    Product instance assignments and role mappings still require one-time manual setup in the Admin Centre •    Initial setup is more complex — requires two separate IdP apps (SSO + SCIM) •    Partner users on external domains cannot share the SCIM-enabled connection </td> </tr> </tbody> </table>2026-06-16T12:37:47.0000000Z

Blog post

Six Compelling Reasons for Upgrading to CMS 13Most software updates ask you to keep up. Optimizely CMS 13 asks something different — it asks whether your digital strategy is built for a world that has already moved on. If your team is still running on CMS 11 or CMS 12, this is not a nudge. It is a wake-up call. CMS 13 is not a patch, not a feature drop, and not the kind of release you can park on a roadmap until next year without consequence. It is a fundamental repositioning of the entire platform around the three forces actively redrawing the map of digital marketing: artificial intelligence, headless content delivery, and AI-powered search. This article lays out a clear-eyed case for why upgrading to CMS 13 is a strategically sound decision for digital and IT leaders in 2026 — and what your teams can realistically expect to gain on the other side. 1. Your Content Editors Will Work Dramatically Faster The most visible change for day-to-day users is Visual Builder — a unified interface that replaces the legacy on-page editor and brings pages, blocks, experiences, media assets, and content variations into one place. Autosave eliminates lost work, synchronised side-by-side preview shows editors exactly what their audience will see before publishing, and Blueprint templates let teams standardise page structures and launch new content without starting from scratch. The productivity gains are measurable: Optimizely's 2025 benchmarking data recorded a reduction of more than 50% in campaign delivery time from brief to publication — translating directly into lower cost-per-campaign and the ability to act on market moments that would previously have been missed. 2. AI Is No Longer an Add-On — It Is the Editorial Workflow Opal, Optimizely's AI agent platform, is embedded directly into CMS 13 — not as an add-on integration but as a native layer within the content graph. Opal agents can draft and publish content from brand guidelines, run content audits, generate metadata and alt text at scale, assist with content modelling, and orchestrate complex workflows across more than 28 purpose-built agent types. The Instructions feature lets teams encode brand voice, compliance requirements, and regional tone variations once — so every piece of AI-assisted content reflects those standards automatically, without manual review. 3. Experimentation at a Scale That Was Previously Impractical One of the persistent frustrations with traditional A/B testing is that it requires traffic volume, manual configuration, and significant editorial time to define audience segments and content variations. Many organisations never fully realise the value of experimentation because the overhead makes it impractical at scale. CMS 13 addresses this through two connected capabilities. -<span style="font-style: normal; font-variant: normal; font-size-adjust: none; font-language-override: normal; font-kerning: auto; font-optical-sizing: auto; font-feature-settings: normal; font-variation-settings: normal; font-weight: normal; font-stretch: normal; line-height: normal;">        Content Variations are built in natively, letting editors maintain multiple published versions of the same content item — each with its own version history — while storing only the properties that differ from the original. Any variation can be promoted to the primary version when performance data supports it. -<span style="font-style: normal; font-variant: normal; font-size-adjust: none; font-language-override: normal; font-kerning: auto; font-optical-sizing: auto; font-feature-settings: normal; font-variation-settings: normal; font-weight: normal; font-stretch: normal; line-height: normal;">        Contextual personalisation rather than requiring manual segment definition, its machine learning model observes real-time visitor signals and automatically surfaces the most relevant experience for each user, learning continuously without ongoing configuration. The result: organisations using Opal alongside CMS 13's experimentation infrastructure recorded close to an 60% increase in experiments run, and better decisions follow when experimentation is this easy to execute. 4. Your Content Will Be Discoverable in AI Search — Not Just Google Search behaviour has shifted. Users are increasingly finding information through AI-powered answer engines — ChatGPT, Google's AI Overviews, Perplexity — which interpret content semantically and surface answers based on clarity and authority, not keyword density or backlinks. Traditional SEO is no longer sufficient; Generative Engine Optimisation (GEO) — structuring content so AI systems can reliably parse, trust, and reference it — is the discipline that now matters. CMS 13 makes GEO a native capability. Optimizely Graph indexes all content semantically — making it inherently more readable to AI systems than content in conventional databases — and the Opal GEO Recommendations agent audits individual pages for LLM discoverability and produces prioritised recommendations to improve visibility across major AI platforms. For organisations that have invested in content marketing, this is a measurable competitive advantage: competitors on CMS 11 or CMS 12 are simply not visible in this channel, while CMS 13 teams can treat AI discoverability as an optimisable marketing channel most of the market has yet to activate. 5. The Financial Case Is Clearer Than It Appears The upgrade case is stronger than it first appears. Staying on legacy infrastructure carries its own costs — in maintenance, security exposure, lost productivity, and features you simply cannot access. On the migration itself, automated tooling delivers an estimated 50% reduction in migration cost for a mid-scale project; campaign delivery times drop by approx. more than 50% with Opal integrated into editorial workflows; and experimentation velocity increases by close to 60% with CMS 13's native variation infrastructure — all of which reduces cost-per-campaign and improves conversion outcomes without adding headcount. Optimizely Graph and Opti ID are also bundled in the CMS 13 license, and the new architecture replaces Search & Navigation entirely, so organisations previously paying for it separately should factor that saving into their cost comparison.   6. You Are Securing the Platform's Future Innovation Path Every major feature Optimizely ships from this point forward is built on the CMS 13 and Graph architecture. The Opal agent library, GEO improvements, new personalisation capabilities and multi-agent workflow orchestration — none of these will be backported to CMS 12 or CMS 11. The longer an upgrade is deferred, the larger the capability gap becomes, and the more complex the eventual migration. Organisations that upgrade now are positioned to adopt each successive improvement incrementally. Organisations that wait face a consolidating backlog of changes to absorb simultaneously. Conclusion Optimizely CMS 13 is not a routine version update. It is the point at which the platform becomes AI-native — where content is structured for machine comprehension, where editorial workflows are accelerated by agents rather than just assisted by tools, and where experimentation and personalisation operate at a scale that was previously reserved for organisations with large, dedicated teams. * Ref <span style="font-size: 11.0pt; line-height: 107%; font-family: 'Calibri',sans-serif; mso-ascii-theme-font: minor-latin; mso-fareast-font-family: Calibri; mso-fareast-theme-font: minor-latin; mso-hansi-theme-font: minor-latin; mso-bidi-font-family: Arial; mso-bidi-theme-font: minor-bidi; mso-ansi-language: #0C00; mso-fareast-language: EN-US; mso-bidi-language: AR-SA;">Sources: Optimizely CMS 13 GA release notes (April 2026), Optimizely Opal AI Benchmark Report (2025), Optimizely Gartner Magic Quadrant (2025)*2026-04-28T12:14:33.0000000Z

Blog post