What is Single Sign-On (SSO)?
Single Sign-On lets your people sign in to MSPCFO with the work account they already use (Microsoft, Google, Okta or Duo) instead of a separate MSPCFO password.
Supported identity providers
| Provider | What you enter in MSPCFO | Notes |
|---|---|---|
| Microsoft Entra ID (formerly Azure AD) | Directory (tenant) ID, Client ID, Client secret | Two optional claims must be added to the app registration. |
| Google Workspace | Google Workspace domain, Client ID, Client secret | Only accounts in your Workspace domain can sign in. |
| Okta | Okta domain, optional Authorization server ID, Client ID, Client secret | Use your org's okta.com address, even if you have a custom domain. |
| Duo Single Sign-On | Duo SSO hostname, Client ID, Client secret | People must be invited to MSPCFO before their first Duo sign-in. |
MSPCFO connects to every provider using OpenID Connect (OIDC). SAML is not supported. Each company can have one SSO configuration with one provider.
What changes for your people
- Signing in: People go to the SSO sign-in page, enter their work email, and are sent to your identity provider to sign in. When they come back, they're signed in to MSPCFO.
- Two-factor authentication: MSPCFO skips its own two-factor code for SSO sign-ins, because your identity provider handles authentication.
- New people: Someone with no MSPCFO account can be given one automatically on their first SSO sign-in, with the profile you choose. (Duo users must be invited first.)
- Passwords: Password sign-in keeps working alongside SSO until you turn on Enforce SSO.
We strongly recommend requiring multi-factor authentication (MFA) in your identity provider, since MSPCFO's own two-factor code is skipped for SSO sign-ins.
Who can use your company's SSO
Your identity provider can sign someone in to MSPCFO only if all of these are true:
- Their email address is on one of your company's registered email domains.
- They belong to your company and no other MSPCFO company.
- They are not MSPCFO staff.
People who belong to more than one MSPCFO company (for example, an outside accountant or consultant) can't use any company's SSO. They keep signing in with their password and two-factor code, even when SSO is enforced. This stops one company's identity provider from opening another company's data.
0 Comments
Add your comment