Turn on single sign-on

Single sign-on ships in every tier. It is not a security add-on and it is not gated behind a plan, because a login you cannot centrally revoke is a risk that does not get smaller for a smaller agency.

What this does

Lets your staff sign in with the account they already use, so joining and leaving your agency is one change in one place.

How to do it

1. In the tenant admin, open Access and choose Single sign-on.
2. Copy the two values shown into your identity provider as a new application.
3. Paste the values your provider returns back into the same screen.
4. Leave the enforcement setting off for now. Turn it on only after step 5 of the check below.

What proves it worked

Have one member of staff sign in through the provider, in a private browsing window, on a device that has never signed in before. Then open the audit record for that sign-in and confirm the method reads as your provider.

The private window matters. A signed-in browser will complete the flow using a session that already existed, which proves nothing about whether the connection works for someone arriving fresh.

Only once that is true do you turn enforcement on. Enforcing before a successful sign-in locks everybody out, including you.

When it does not work

If the provider returns an error about the reply address, the value was pasted with a trailing space or with the wrong protocol. The screen shows the exact string we expect and the exact string we received.

If sign-in completes but lands on an access denied page, the person exists at your provider and has no role in the tenancy. That is the correct behaviour: a valid identity is not an authorisation. Assign the role and try again.

Recovery

Keep one break-glass account that signs in with a password and a second factor, held by a director. If your provider has an outage, that account is how you get back in. It is recorded in the audit trail every time it is used, and that is deliberate.