Set up single sign-on with Microsoft Entra ID
Let members sign in with their Microsoft Entra ID work account, and decide whether it is the only way in.
Screenshots are retaken from IQ Entities on every release. Updated 14 October 2026.
Most firms already manage their people's accounts in Microsoft Entra ID. With single sign-on, members sign in to IQ Entities with that work account instead of a separate password. Your IT team connects Entra ID through a setup link, and IQ Entities never sees your credentials. Entra ID is the identity provider single sign-on works with.
It is set up by an administrator with the permission to manage the organisation's settings, together with whoever administers Entra ID. Two things to decide: who in IT will finish the setup, and whether single sign-on becomes the only way in or sits beside passwords.
Before you start
- Someone who administers your Entra ID tenant and can register an application there.
- Access to your email domains' DNS, or the person who has it: the setup asks you to prove you own each domain your people sign in with.
- Everyone who will sign in already invited as a member. Single sign-on lets members in; it does not create them. See Invite a colleague.
Send the setup link to IT
In Administration, open Sign-in Security, or click the Single sign-on tile in Integrations and then Set up. The Single sign-on card shows Not set up until a connection exists.
Choose Set up single sign-on. A link appears, with the date it works until. It is shown only once, so choose Copy and send it to whoever administers your identity provider. Treat it like a password.
Your IT team follows the guided setup, including proving the email domains people sign in with. While they work, the card says Waiting on your IT team, and it updates itself when they finish.
If the link expires or goes astray, choose New setup link; each request issues a new one.
Choose break-glass accounts
Break-glass accounts keep password sign-in, so a broken identity provider cannot lock everyone out. At least one must be able to manage settings.
Under Break-glass accounts, tick one or two administrators.
Choose Save break-glass accounts. The ticks are not kept until you do.
Choose how people sign in
Once the connection is Live, the card shows the Identity provider and the Email domains it covers, and offers three ways in.
| What you want | What to choose |
|---|---|
| Keep the connection but send nobody to it for now | Password only |
| Members on your domains use their work account; anyone else uses a password | Single sign-on or password |
| Password sign-in stops for everyone on your domains, apart from the break-glass accounts | Single sign-on only |
Single sign-on only cannot be chosen until a break-glass account has been saved.
To stop sending people to Entra ID, during an outage or a change of tenant, choose Password only. The connection is kept, so switching back needs no new setup.
Tips from practice
- Start with Single sign-on or password for a week and check the member list at the foot of Sign-in Security, where Signs in with shows who has moved over, before switching to Single sign-on only.
- If the card says nobody is routed to the connection yet, no email domain is attached to it. Send a new setup link and have IT add and verify your domains.
- Choose break-glass accounts that are not used day to day, and keep their passwords somewhere your firm can reach in an outage.
Related: Require two-factor authentication and Invite a colleague.