ClientOne Microsoft 365 SSO (MSP)
This guide walks an MSP admin through turning on the multi-tenant Sign in with Microsoft 365 flow for ClientOne. End users at every client tenant can sign in with their existing M365 account without per-tenant SSO configuration in PanelOne.
Note: The same procedure is in PanelOne → ClientOne Admin → ClientOne SSO (
/clientone-admin/sso). In-repo strings:panelone/src/features/clientone-sso/setup-guide-content.ts; long-form runbook:panelone/docs/clientone-sso-msp-runbook.md. Update all sources when instructions change.
It is different from per-client Entra SSO (one app per client). Both flows coexist; the login page prefers ClientOne M365 SSO when the MSP has it enabled.
Overview of the pieces
| Piece | What it is | Where it lives |
|---|---|---|
| ClientOne Azure App | Multi-tenant Azure App Registration in your partner tenant. | Azure Portal |
| Partner Center app (optional) | AAD app for Partner Center automation of admin consent. | Azure Portal + Partner Center |
| PanelOne — ClientOne SSO | Where you paste credentials. | /clientone-admin/sso in PanelOne |
| Grant ClientOne consent | Per-client action to consent the app in that tenant. | Client detail page in PanelOne |
| End-user login | ClientOne sign-in URL. | Default https://app.clientone.dev/login or your ClientOne origin |
1. Register the multi-tenant Azure App
- Open Azure Portal in your partner tenant.
- Microsoft Entra ID → App registrations → New registration.
- Name: e.g.
ClientOne SSO(customers see this on consent). - Supported account types: Accounts in any organizational directory (multitenant).
- Redirect URI: leave blank for now; paste the URL from PanelOne in the next phase.
- API permissions: add Microsoft Graph delegated:
openid,profile,email,User.Read. Grant admin consent in your partner tenant.
2. (Optional) Register a Partner Center app
Skip if you will run manual admin consent URLs in every client tenant instead of using Grant ClientOne consent in PanelOne.
- New registration — single tenant; name e.g.
PanelOne Partner Center. - API permission: Microsoft Partner Center → user_impersonation (Delegated); grant admin consent.
- Create a client secret; copy the secret value.
- MSP account needs a valid Partner Center role.
3. Paste credentials into PanelOne
- ClientOne Admin → ClientOne SSO in PanelOne (Owner/Admin only).
- Copy Redirect URI (ends with
auth-clientone-sso-callback). - In the ClientOne Azure App: Authentication → Web — paste that URI exactly and save.
- Create an Azure client secret; copy the value.
- In PanelOne fill Azure client ID and Azure client secret (first save requires both).
- If using Partner Center automation, fill Partner tenant ID, Partner Center client ID, and Partner Center client secret.
- Optional ClientOne origin for a whitelabel hostname.
- Toggle Enable ClientOne SSO and Save changes.
Secrets are encrypted per organization; they are not returned to the browser after save.
4. CIPP tenant sync
sync-cipp-tenants (daily 02:00 UTC) fills microsoft_tenant_id on clients so login routing and consent work.
Example manual run:
curl -X POST \
-H "Authorization: Bearer <anon-key>" \
https://<project-ref>.supabase.co/functions/v1/sync-cipp-tenants
Confirm each client shows a tenant ID on its Client Info card.
5. Turn on SSO for each client tenant
- Clients → [client].
- ClientOne Microsoft 365 SSO card → Grant ClientOne consent (requires Partner Center credentials in step 3).
If you skipped Partner Center:
- Open as Global Admin in the client tenant:
https://login.microsoftonline.com/<client-tenant-id>/adminconsent?client_id=<clientone-azure-app-id>
- Then set
clients.clientone_sso_enabled = true(or use product UI when available).
6. End users sign in
Direct users to your ClientOne origin or https://app.clientone.dev/login. They enter email and choose Sign in with Microsoft 365.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Microsoft sign-in not fully configured | is_enabled but no Azure secret stored | Re-save ClientOne SSO with a valid secret |
Redirect returns sso_error | Bad/expired secret or redirect mismatch | Rotate secret; match redirect exactly |
| Token tenant mismatch | Wrong microsoft_tenant_id on client | Re-run sync / correct tenant ID |
| Partner Center consent 401 | Invalid Partner app credentials or role | Fix credentials / Partner Center role |
sync missing_client_secret | CIPP secret missing | Reconfigure CIPP integration |