Single Sign-On (SSO): Overview

Part3 now supports single sign-on (SSO). Your team can sign in to Part3 with the same work account they already use for email and everything else at your company, with no separate Part3 password to remember.

This article explains what single sign-on is, what changes for your team, and what you'll need to get started. When you're ready to set it up, the step-by-step guides are linked at the bottom.

In this article we'll cover the following:

• What is single sign-on?
• Why use it
• What your team will see
• Who sets it up
• What you'll need
• How setup works
• FAQ

What is single sign-on?

Single sign-on lets people use one work account to sign in to many apps. Instead of creating a Part3 password, your team signs in through your company's identity provider, the system your IT team already uses to manage work accounts.

Today, Part3 supports Microsoft Entra ID (formerly Azure Active Directory), the identity provider behind Microsoft 365, using the OIDC standard. If your team signs in to Outlook and Teams with their work email, you most likely use Entra ID.

Why use it

• One less password. Your team signs in with the work account they already know. Nobody has to create, remember or reset a Part3 password.
• Your IT team stays in control. Your company's password rules and multi-factor authentication (MFA) apply when people sign in to Part3, because they sign in through Microsoft.
• Offboarding is simpler. Once someone has signed in with Microsoft, turning off their work account stops them signing in to Part3. Admins and IT admins keep a Part3 password, so remove them from your Part3 organization when they leave.
• Faster onboarding. New hires with a company email can sign in to Part3 with their work account on day one.

What your team will see

Once single sign-on is on, signing in looks like this:

Step 1: Go to the Part3 sign-in page, enter your work email and select Continue.

Step 2: Part3 recognizes your company's domain and sends you to Microsoft to sign in. If you're already signed in to Microsoft on that computer, this can take just a moment.

Step 3: You're brought back to Part3, signed in.

That's it. There's no Part3 password to enter. ✨

Who sets it up

Single sign-on is set up in your organization's settings by one of these people:

• Organization admins
• IT admins, a new organization role for the person in your IT team who manages sign-in. IT admins don't use a paid seat. See The IT admin role.

Setup involves a few steps in Microsoft Entra, so most companies have someone from IT do it, either as an IT admin in Part3 or alongside an organization admin.

What you'll need

• An organization admin or IT admin in Part3 to set it up. IT admins don't use a paid seat. See The IT admin role.
• Microsoft Entra ID, and someone who can register an application in it.
• Your company's email domain (for example, acme.com) added to Part3 and verified. Verifying proves your organization owns the domain. It takes one DNS record. See Verify your email domains.
• A Part3 password for every admin and IT admin on that domain. It's a backup way in to fix or turn off single sign-on if signing in with Microsoft fails.

How setup works

Setup comes down to four steps. The longest wait is usually for your DNS change to show up.

1. Verify your email domain in Part3 by adding a DNS record. Verify your email domains
2. Register Part3 in Microsoft Entra and copy a few details into Part3.
3. Test it. Part3 checks your Entra setup and has you run a test sign-in with your own account. Nobody else is affected yet.
4. Turn it on. From then on, people on your domain sign in through Microsoft.

Steps 2 to 4 are covered in Set up single sign-on with Microsoft Entra ID: step 2 is Parts 1 and 2 there, step 3 is Parts 3 and 4, and step 4 is Part 5.

FAQ

Q: Does turning on single sign-on sign anyone out?

No. People stay signed in. They'll go through Microsoft the next time they sign in.

Q: What about people outside my company, like consultants and contractors?

Nothing changes for them. Single sign-on only applies to people with an email at your verified domain. External collaborators keep signing in the way they do today.

Q: What happens if someone new at my company signs in with single sign-on?

If they have an email at your domain, they get a Part3 account and join your organization the first time they sign in. Like anyone with your company email, they join as a Member and use a paid seat, unless you invited them with a different role first. If you're out of seats, your billing admins (the people who manage billing for your organization) get a request to approve.

Q: What if Microsoft is down, or something is set up wrong?

Organization admins and IT admins keep a Part3 password for emergencies. If signing in with Microsoft fails, Part3 offers Sign in with a password, so they can fix the connection or turn single sign-on off for everyone. If that option doesn't appear, contact support@part3.io.

Q: Does Part3's own multi-factor authentication still apply?

Yes. If someone has set up multi-factor authentication in Part3, Part3 still asks for their code after they sign in with Microsoft. Your company's Microsoft MFA rules apply too.

Q: Does signing out of Part3 sign me out of Microsoft?

No. Signing out of Part3 only signs you out of Part3.

Q: We use Okta, Google or another identity provider. Can we use single sign-on?

Not yet. Part3 currently supports Microsoft Entra ID using OIDC. We plan on supporting SAML and other identity providers, such as Okta, in the future. Let us know at support@part3.io which provider you use, so we can prioritize it.