ClientOne Microsoft 365 SSO (MSP)
This guide walks an MSP admin through turning on the multi-tenant Sign in with Microsoft 365 flow for ClientOne. End users at every client tenant can sign in with their existing M365 account without per-tenant SSO configuration in PanelOne.
Note: The same procedure is in PanelOne → ClientOne Admin → ClientOne SSO (
/clientone-admin/sso).
It is different from staff Entra SSO (PartnerOne sign-in for MSP staff) and from per-client ClientOne SSO under ClientOne Admin. The ClientOne login page prefers this Microsoft 365 flow when you have it enabled.
Overview of the pieces
| Piece | What it is | Where it lives |
|---|---|---|
| ClientOne Azure App | Multi-tenant Azure App Registration in your partner tenant. | Azure Portal |
| Partner Center app (optional) | AAD app for Partner Center automation of admin consent. | Azure Portal + Partner Center |
| PanelOne — ClientOne SSO | Where you paste credentials. | /clientone-admin/sso in PanelOne |
| Grant ClientOne consent | Per-client action to consent the app in that tenant. | Client detail page in PanelOne |
| End-user login | ClientOne sign-in URL. | Default https://app.clientone.dev/login or your ClientOne origin |
1. Register the multi-tenant Azure App
- Open Azure Portal in your partner tenant.
- Microsoft Entra ID → App registrations → New registration.
- Name: e.g.
ClientOne SSO(customers see this on consent). - Supported account types: Accounts in any organizational directory (multitenant).
- Redirect URI: leave this blank. Automated setup registers the callback — do not add one by hand.
- API permissions: add Microsoft Graph delegated:
openid,profile,email,User.Read. Grant admin consent in your partner tenant.
2. (Optional) Register a Partner Center app
Skip if you will run manual admin consent URLs in every client tenant instead of using Grant ClientOne consent in PanelOne.
- New registration — single tenant; name e.g.
PanelOne Partner Center. - API permission: Microsoft Partner Center → user_impersonation (Delegated); grant admin consent.
- Create a client secret; copy the secret value.
- MSP account needs a valid Partner Center role.
3. Paste credentials into PanelOne
- ClientOne Admin → ClientOne SSO in PanelOne (Owner/Admin only).
- Follow the on-screen setup. Automated setup registers the Entra callback — do not add a redirect URI by hand.
- Create an Azure client secret; copy the value.
- In PanelOne fill Azure client ID and Azure client secret (first save requires both).
- If using Partner Center automation, fill Partner tenant ID, Partner Center client ID, and Partner Center client secret.
- Optional ClientOne origin for a whitelabel hostname.
- Toggle Enable ClientOne SSO and Save changes.
Secrets are encrypted per organization; they are not returned to the browser after save.
4. CIPP tenant sync
Microsoft 365 / CIPP sync does not use a redirect URI. CIPP uses the Entra app’s client ID and secret only.
When CIPP is connected, PanelOne syncs each client's Microsoft tenant ID so login routing and consent work. Confirm each client shows a tenant ID on its Client Info card. If a tenant ID is missing after you connect CIPP, trigger a CIPP sync from PanelOne or wait for the next scheduled sync.
5. Turn on SSO for each client tenant
- Clients → [client].
- ClientOne Microsoft 365 SSO card → Grant ClientOne consent (requires Partner Center credentials in step 3).
If you skipped Partner Center:
- Open as Global Admin in the client tenant:
https://login.microsoftonline.com/<client-tenant-id>/adminconsent?client_id=<clientone-azure-app-id>
- Then enable ClientOne Microsoft 365 SSO for that client in PanelOne when the product UI offers it.
6. End users sign in
Direct users to your ClientOne origin or https://app.clientone.dev/login. They enter email and choose Sign in with Microsoft 365.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Microsoft sign-in not fully configured | is_enabled but no Azure secret stored | Re-save ClientOne SSO with a valid secret |
Redirect returns sso_error | Bad/expired secret or setup incomplete | Rotate the secret and re-run ClientOne SSO setup (do not add a callback URL by hand) |
| Token tenant mismatch | Wrong microsoft_tenant_id on client | Re-run sync / correct tenant ID |
| Partner Center consent 401 | Invalid Partner app credentials or role | Fix credentials / Partner Center role |
sync missing_client_secret | CIPP secret missing | Reconfigure CIPP integration |