Skip to main content

Set up Microsoft Entra SSO

Set up Microsoft Entra sign-in for staff at admin.partnerone.dev/sso. PartnerOne creates a single-tenant app in your Entra tenant, so there are no redirect URIs to add.

This is for MSP staff signing in through PartnerOne. It is not ClientOne Microsoft 365 SSO for your customers.

Microsoft Entra is the only SSO provider in this release. Password sign-in stays available while SSO is on, and so does passkey sign-in (passkeys are registered from Admin — see Passkeys).

Before you start​

  • Sign in to PartnerOne Admin as an owner or admin. You need a recent MFA sign-in.
  • The person who clicks Connect Microsoft Entra signs in to Microsoft and consents themselves. Their Microsoft account must hold an active Global Administrator role. An eligible-but-inactive PIM assignment fails.
  • Only verified custom domains are offered (not *.onmicrosoft.com). Each tenant or domain can belong to only one PartnerOne organisation.

Set up SSO​

Complete the steps in this order:

  1. Connect Microsoft Entra — sign in with the active Global Admin account and grant consent.
  2. Choose a verified domain.
  3. Start SSO test.
  4. I completed the test.
  5. Activate SSO.

To turn SSO off later, use Disconnect SSO.

Assign staff in Entra​

The Entra app is created with assignment required. Only the person who set it up is assigned.

Assign other staff to the app in Entra before they try Microsoft sign-in. Until you do, only the admin who connected Entra can use it.

What staff see​

Staff open a PartnerOne app and are sent to login.partnerone.dev. They enter their email, then continue with Microsoft if SSO is on for their domain — or use their password.

By default they still complete PartnerOne MFA (authenticator or passkey) after Entra. Entra SSO does not replace that second factor. You must set up and use a second factor to access PartnerOne apps; your organisation can't switch MFA off.