How SSO Matches and Creates Accounts
First SSO sign-in for an existing member
Someone who already has an MSPCFO account at your company is matched by their email address the first time they sign in with SSO. From then on, their MSPCFO account is linked to their identity provider account, and later sign-ins match on that link rather than the email. Their profile and access don't change.
For Entra, Google and Okta, the provider must confirm it verified the email address before MSPCFO matches it. Each provider's setup article explains how to make sure it does.
First SSO sign-in for someone new
When someone with no MSPCFO account signs in with SSO, MSPCFO creates their account automatically, as long as:
- their email is on one of your company's domains,
- your identity provider confirms the email address is verified, and
- no other MSPCFO company with SSO uses the same email domain.
The new account is added to your company with the Profile for new SSO users. No invitation email is sent. The name comes from the identity provider. Like every new user, they accept the MSPCFO end-user license agreement on their first visit.
Controlling who gets in: Anyone your identity provider lets into the MSPCFO application can get an MSPCFO account at your company. Use your provider's assignment settings (assigned users or groups) to decide who may use the MSPCFO app.
Duo: Duo doesn't confirm email addresses, so Duo sign-ins don't create new MSPCFO accounts. Invite each person on the Users page first.
Shared email domains
If another MSPCFO company with SSO also has your email domain registered, MSPCFO can't tell which company a brand-new address belongs to, so it won't create the account. Invite the person on the Users page first; then they can sign in with SSO. Existing members aren't affected.
0 Comments
Add your comment