Single sign-on

What to tell customers about signing in with their own company accounts. The product details are on the Product space's Single sign-on page.

How it works

People sign in through Entra ID or Okta over SAML, switched on one depot (or site) at a time. Until a depot switches, its people keep their passwords.

• The customer's IT sets up the connection in their Entra ID or Okta, one app per depot, and uploads the depot's metadata in the portal (SAML metadata upload, since 18 August).
• An administrator switches each depot on in the portal's single sign-on settings, after a rehearsal with a test account.
• From then on, the depot's people sign in with their company account. Anyone already signed in stays signed in until their session ends; the switch signs nobody out.
• People who sign in with phone codes (workers without a company email) keep their phone codes.
• If something goes wrong, an administrator switches the depot back to passwords. It takes a few minutes.

Roles

• The customer's groups in Entra ID or Okta give people their roles, and they are applied again at every sign-in.
• A depot approver assignment made in the portal is left alone by sign-in, so a depot manager keeps the depot they approve for.

What it doesn't do

• Accounts aren't made from Entra ID or Okta. An administrator adds each person, or imports them from a spreadsheet. There is no SCIM.
• Every depot at once isn't possible yet. ACM-293 will let an administrator switch every tested depot in one go, and one depot back alone; people will keep their passwords for 14 days after their depot switches. It is in delivery; don't promise a date.
• Other identity providers (anything that isn't Entra ID or Okta) are untested. Say so, and offer a test with Tom.

Questions customers ask

Do our people need new accounts? No. They use the account they already have at work. We match them to the person we hold by their email.

What about MFA? Their own MFA in Entra ID or Okta covers every sign-in. MFA in the portal is still required for administrators who sign in with a password.

How long does a depot take? Setting up the app and metadata: an hour for their IT. The switch itself: seconds. Plan a rehearsal the Thursday before and switch before the first shift.

Brakeline did it how? Nine depots over two weekends in March, no downtime: Brakeline single sign-on rollout.

Change history

Version	Date	Who	What
1	30 Jan 2023	Ana	Entra ID, depot by depot
6	10 Jun 2024	Ana	Okta untested; SCIM not available
8	23 Mar 2026	Ana	Brakeline's rollout as the example
9	23 Jun 2026	Clara	Okta supported (Vossberg)
10	17 Jul 2026	Clara	People import from a spreadsheet
11	19 Aug 2026	Clara	Metadata upload by the customer's IT
12	2 Oct 2026	Ana	Depot approver assignments survive sign-in (ACM-247)
13	20 Oct 2026	Ana	ACM-293 in delivery; 14 days of passwords after the switch