Qualtrics Security: Secure brand admins, SSO, API tokens and respondent data

Qualtrics holds survey responses, contact directories and often employee feedback that respondents were promised would stay confidential, so brand administration, API tokens and retention rules decide whether that promise holds. Qualtrics organises customers into brands (organisations) with divisions, user types and permissions, and Brand Administrators control sign-in, sessions, retention and anonymity settings for everyone. This guide covers how to set up SSO and two-factor authentication, how to manage Brand Administrator access and proxy login, how to handle API tokens and OAuth clients, how to configure retention and anonymisation policies, and how to use the activity logs. It is written for Brand Administrators, CX and EX programme owners, and the security and privacy teams that review them.

This is an independent guide from NHI Mgmt Group, based on Qualtrics's public documentation as of November 2026. It is not sponsored or reviewed by Qualtrics. Product features change, so confirm settings against Qualtrics's current documentation.

Key takeaways

• Brand Administrators hold the keys. They edit every user, set security and retention policy and, with Allow Proxy Logins on, can sign in as other users; keep the role small and decide on proxy login deliberately.
• SSO first, 2FA for the rest. 2FA applies to non-SSO users only; once SAML works, disable the Qualtrics Login connection so everyone signs in through your identity provider.
• Treat API tokens as passwords. Each user generates their own token through Qualtrics IDs; prefer OAuth clients with the Client Credentials grant for integrations and store the secret at creation.
• Set retention policies. Response deletion, response anonymisation and contact deletion policies run on a schedule and are irreversible, so pilot them with survey exceptions.
• Export the activity logs. Logins, failed logins, API token changes, API access and anonymity setting changes are in the Security tab and export as CSV or TSV.

How identity and access work in Qualtrics

A brand contains users, groups and divisions. Each user has a user type, a preset bundle of permissions, and permissions can be set at organisation, division and user level. A permission disabled at a higher level is greyed out below until it is enabled above. Qualtrics documents several default user types:

Division Administrator is a division setting, not a user type. Qualtrics notes that most brands keep two to four user types, that existing user types cannot be modified (create a new one instead), and that changing a user's type updates their permissions automatically. Avoid one-off manual permission changes, which drift from the user type and are hard to review. The Limit EX Admin Update Person setting stops EX Administrators and Employee Insights Admins from editing Brand Admin user data; keep it on.

SSO and two-factor authentication

• Login types: Organization Settings, Authentication lists Qualtrics, OAuth 2.0 and SAML login types, each with an enable toggle. Brand Administrators can manage SAML connections there.
• Require SSO: disable the "Qualtrics Login for [Your Organization ID]" connection. Qualtrics warns that this requires all users to sign in through SSO and affects the whole user base, so test the SAML connection with a pilot group first.
• Force authentication: when adding a certificate, select Sign request and, if wanted, Force authentication, so the identity provider re-authenticates users even with an existing session.
• Provisioning: JIT provisioning can be set on a connection, and SSO attributes can assign new users to a user type or division automatically. Removing access in your identity provider stops new sign-ins; also disable the Qualtrics account through your leaver process.
• Certificates: add the new IdP certificate before the old one expires, test, then remove the old one (encryption certificates need fresh IdP metadata instead).
• 2FA: Qualtrics supports email codes, authenticator apps and backup codes, and is making 2FA mandatory, with a 30 day extension a Brand Administrator can request. Only a Brand Administrator can enable it, and enabling is permanent. 2FA does not apply to SSO users on SSO brands or to Participants, so MFA for SSO users is enforced in your identity provider. Use phishing-resistant MFA there; see the Phishing-Resistant MFA Guide.

See the Identity Provider and SSO Security Guide and the Joiner-Mover-Leaver Guide.

Availability: Qualtrics describes SSO as a paid feature and the Qualtrics API as a licensed feature; confirm both with your Account Executive.

Session and account settings

Admin roles and privileged access

The Brand Administrator role can change any user, every security setting, SSO, retention and anonymity thresholds. Several capabilities deserve explicit decisions:

1. Keep Brand Administrators few: two or three named people (ours), with CX Administrator or Division Administrator used for delegated work.
2. Decide on proxy login: Allow Proxy Logins lets Brand Admins or higher sign in to other users' accounts, and on Employee Experience licences lets EX project builders proxy into participants' dashboards. If you keep it for support, record when it is used and review the activity log; otherwise deselect it.
3. Review EX access: EX Administrators and Employee Insights Admins can reach global employee directories, which hold HR data. Review them as often as Brand Administrators.
4. Control self-enrolment: a self-enrolment access code under Organization Settings, General lets people create accounts; rotate or remove it if SSO handles provisioning.
5. Restrict sharing outward: use Restrict surveys to domain where surveys are internal, and Enable allowed email domains (which applies to emailing dashboards) to limit where dashboards are sent.
6. Review quarterly (our cadence): Brand Administrators, division admins, user types and manual permission overrides. See the Access Reviews Guide.

Integrations, API tokens and service accounts

Qualtrics offers two API credential types. Both are non-human identities that act with a user's permissions.

• Tokens replace passwords: Qualtrics says the token replaces your password and must be kept secure, and that each user in a licence generates their own token.
• Regeneration: generating a new token is irreversible and breaks extensions using the old one. Plan the cut-over, then regenerate whenever a token may have been exposed.
• OAuth secrets: the Client Secret cannot be retrieved after the creation window closes; store it in a secrets manager at once, or create a new client.
• Limit Access API: grant the Access API permission through a dedicated user type or group, not to every Standard user.
• Integration accounts: run long-lived integrations under a dedicated, SSO-governed service user with only the projects it needs, not a person's account, so a leaver does not break or keep an integration.

Public API controls

Organization Settings has a Public API section with three controls worth turning on where your integrations can support them: Mutual Transport Layer Security (requires mTLS certificates on public API calls), IP Address Allowlisting for users with IP restrictions, and Add User Rate Limit for per-user API limits. Test each with one integration before applying broadly.

See the API Key Management Guide, the Machine-to-Machine OAuth (Client Credentials) Guide and the Non-Human Identity (NHI) Guide.

Respondent data, retention and anonymity

Retention policies

Under Admin, Data Privacy, Retention Policy, Brand Administrators set one default per brand for each policy type:

• Irreversible and retroactive: deleted responses and anonymised data cannot be retrieved, and rules apply to existing records, including those created before the rule. Manually edited response fields are not touched.
• Schedule: policies run every 24 hours by default (daily to yearly, or never), and "Run all policies now" runs them immediately.
• Exceptions: use "Add an exception" for surveys under legal hold or longitudinal studies.
• Evidence: the event log keeps retention events and policy changes for 12 months.
• Scope: only Brand Administrators can set these policies, and anonymisation policies are not available for EX licences.

Anonymity thresholds

For brands with Engagement, Lifecycle, Ad Hoc Employee Research or Pulse projects, Admin, Data Privacy, Anonymous responses sets brand-wide minimum responses before datapoints and comments appear in dashboards. Every dashboard must meet them or be stricter. Set them with HR and works councils so employee surveys keep the confidentiality respondents were promised.

The strongest control is collecting less: avoid asking for identifiers you will not use. See the Data Minimisation guide, the Data Retention and Secure Deletion Guide and the Employee Monitoring and Privacy Guide.

Logging and detection

The Security tab holds two views. Active Sessions lists signed-in users with End Session and End All Sessions actions, which is your first containment step for a suspected account takeover. Activity Logs record user actions, filtered by time range, event and search term, and export as CSV or TSV. Events include Login, Failed logins, session creation and termination, API token change, API access, password change and reset, brand anonymity setting change and EX pseudonymisation.

Export the logs on a schedule into your SIEM, and correlate with your identity provider's sign-in records.

Metrics: number of Brand Administrators; percentage of users signing in by SSO (target 100% outside Participants); users holding Access API; OAuth clients with a named owner; surveys covered by a retention policy or a documented exception; inactive accounts disabled within the set period.

Hardening baseline

1. Inventory: list Brand Administrators, division admins, user types, Access API holders, OAuth clients and integrations.
2. Enable 2FA now for non-SSO users if your brand has not yet been switched.
3. Connect SAML, test with a pilot group, turn on Force authentication, then disable the Qualtrics Login connection. Roll back by re-enabling it from a Brand Administrator session.
4. Set session and lockout values and Disable Inactive Accounts.
5. Cut privileged access: reduce Brand Administrators, decide on Allow Proxy Logins, and review EX directory access.
6. Move integrations to OAuth clients under service users, restrict Access API, and turn on mTLS, IP allowlisting and rate limits where supported.
7. Set retention and anonymisation policies, starting with exceptions for any survey under hold; run on one division's surveys first where possible.
8. Set anonymity thresholds for employee programmes.
9. Export activity logs to the SIEM and alert on the signals above.

Common misconfigurations

• SSO configured but Qualtrics Login left on: users can still sign in with a password, outside identity provider MFA and leaver controls.
• Proxy login left on without oversight: admins can act as users with no review of when it happens.
• Integrations on personal tokens: an integration breaks or stays live when its owner leaves, and regenerating the token breaks every extension using it.
• Access API granted to everyone: every Standard user can generate a token that replaces their password.
• No retention policy: years of responses and contacts kept with no deletion or anonymisation schedule.
• Retention without exceptions: an irreversible policy deletes data under legal hold.
• Concurrent session limit at default: 500 sessions per user makes shared or stolen accounts hard to spot.

Framework mapping

Practitioner checklist

• SAML SSO with Force authentication, and the Qualtrics Login connection disabled.
• 2FA enabled for every remaining non-SSO user; phishing-resistant MFA at the identity provider.
• Session timeout, concurrent session limit, lockout and Disable Inactive Accounts set.
• Two or three Brand Administrators; Allow Proxy Logins decided and documented.
• EX directory access reviewed on the same cycle as Brand Administrators.
• Access API limited to a dedicated user type; integrations on OAuth clients under service users.
• mTLS, IP allowlisting and API rate limits turned on where integrations support them.
• Response deletion, anonymisation and contact deletion policies set, with exceptions for holds.
• Anonymity thresholds set for employee programmes.
• Activity logs exported to the SIEM and reviewed.

Standards and references

• Qualtrics: Security tab
• Qualtrics: Organization settings
• Qualtrics: Configuring organization SSO settings
• Qualtrics: Two-factor authentication
• Qualtrics: User types
• Qualtrics: API overview
• Qualtrics: Retention policies
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: SaaS Security Guide · Identity Provider and SSO Security Guide · API Key Management Guide · Data Retention and Secure Deletion Guide