Client secrets in Entra (and some other providers) expire. You can change the client secret, or any other credential, while SSO is enforced, without locking anyone out.

1. Create a new secret in your identity provider

Follow the client secret step in your provider's setup article. Copy the new secret.

2. Paste it into MSPCFO

On the Single Sign-On page, choose Edit, paste the new value into Client secret, and choose Save changes.

3. Enforcement pauses automatically

Because the new values haven't been proven yet, enforcement is paused:

• The Enforce SSO row reads Yes — paused until a Test sign-in succeeds with the current settings. Password login stays open until then.
• Password sign-in works again in the meantime, so nobody is locked out if the new values are wrong.

[SCREENSHOT: Enforce SSO row showing the "paused" message]

4. Run Test sign-in straight away

Run Test sign-in. When it succeeds, enforcement resumes by itself.