Run a Test Sign-in
A test sign-in runs one real sign-in through your identity provider using the settings you saved. When it succeeds, the configuration is marked Verified, which unlocks Enforce SSO.
You'll be signed in as whoever your provider authenticates.If your browser is already signed in to your identity provider as someone else, or you pick a different account, you'll come back to MSPCFO signed in as that person, and your own session will be signed out. Use a private/incognito browser window, or check which account your provider is using, before you test.
If you belong to more than one MSPCFO company, you can't complete the test, because SSO never signs in multi-company accounts. Ask a colleague who belongs only to your company to run it.
1. Start the test
On the Single Sign-On page, choose Test sign-in and confirm. (The button appears only while SSO is enabled.)
[SCREENSHOT: Single Sign-On page with the Test sign-in button]
2. Sign in at your identity provider
You're sent to your identity provider. Sign in with an account that:
- has an email address on one of your company's domains, and
- belongs only to your company in MSPCFO, or has no MSPCFO account yet.
3. Confirm it's verified
When you come back, the Verified row on the Single Sign-On page readsYes — first successful sign-in followed by the date.
[SCREENSHOT: Verified row showing "Yes — first successful sign-in" and date]
If the test fails
- An error page at your identity provider (for example "redirect URI mismatch", "application not found" or "invalid client"): the callback URL, client ID or directory/domain doesn't match what's registered in your provider. Recheck those values in your provider's article.
- Back on the Single Sign- On page with a message: the provider accepted the settings, but MSPCFO refused the person. Look up the message in SSO Sign-In Error Messages.
When verification is cleared
Changing any of these clears Verified: the provider, directory/domain/hostname, client ID, client secret, or Okta authorization server. Run Test sign-in again afterwards.
Changing only the Profile for new SSO user or the Enabled setting keeps Verified.
0 Comments
Add your comment