Before You Set Up SSO
Check each item below before you start.
1. SSO is turned on for your company
SSO is switched on per company by MSPCFO. Open the user menu (top right of MSPCFO). If you don't see Single Sign-On, contact MSPCFO Support and ask for SSO to be enabled.
2. Your email domains are registered
MSPCFO only accepts SSO sign-ins for email addresses on your company's registered domains (for example yourcompany.com).
You can't add domains yourself. If one is missing (for example, a second brand domain), contact MSPCFO Support to add it.
3. You're a company administrator
Only administrators of your company (the Admin role) can see and change the Single Sign-On page.
4. You can sign in to your provider's admin console
You'll create an application in your identity provider. This usually requires an administrator role in Entra, Google Workspace, Okta or Duo.
5. You have someone to run the test sign-in
The test sign-in must be done by someone who belongs only to your company in MSPCFO and has an account in your identity provider.
6. You've chosen a profile for new SSO users
Decide which MSPCFO user profile people get when SSO creates their account. Pick the one with the least access most people need. You can change any individual's profile later on the Users page.
Callback (redirect) URLs
Every provider asks for are direct URI (also called a callback URL or sign-in redirect URL). The Single Sign-On page shows the right one for the provider you pick. For reference:
| Provider | Callback URL |
|---|---|
| Microsoft Entra ID |
https://app.mspcfo.com/user/auth/entra_id/callback |
| Google Workspace |
https://app.mspcfo.com/user/auth/google_oauth2/callback |
| Okta |
https://app.mspcfo.com/user/auth/okta/callback |
| Duo Single Sign-On |
https://app.mspcfo.com/user/auth/duo/callback |
Copy the URL exactly: https, no trailing slash, no extra spaces. A mismatched redirect URI is the most common cause of a provider error page during the test sign-in.
0 Comments
Add your comment