Skip to main content
Regentra supports single sign-on through Microsoft Entra ID (Azure AD) for both staff login and customer portal login. SSO uses the OAuth2 authorization code flow.

​
Staff SSO

Enable SSO so your team members sign in to app.regentra.io with their Microsoft credentials instead of a separate Regentra password.

​
Setup

There’s no Azure app registration to create and no Tenant ID / Client ID / Client Secret to enter — staff SSO authenticates through Regentra’s own multi-tenant Azure AD app, and setup is a single click.
1

Open Authentication & SSO settings

Go to Settings → Authentication & SSO.
2

Connect with Microsoft

Click Connect with Microsoft. You’re redirected to a Microsoft sign-in — Regentra detects your Azure tenant automatically from that sign-in. Only a normal sign-in is required; no admin consent or extra Azure permissions are needed.
3

SSO is on

Once connected, the card shows Entra ID Single Sign-On with an Enabled badge and your (partially masked) tenant ID. Use the toggle to pause SSO without losing the connection, or Disconnect to remove it entirely.
Enabling SSO does not disable email/password login. Users can sign in with either method — Regentra has no separate “SSO-only, no passwords” enforcement setting.

​
Portal SSO

Portal SSO lets portal contacts synced from Entra sign in to the support portal with their own Microsoft work accounts, instead of a portal password. It’s two separate pieces: connecting a client’s Microsoft 365 tenant, and turning the portal-wide sign-in toggle on.
1

Connect the client's Microsoft 365 tenant

Switch into the client, go to PSA → Companies, open the company, and find the Microsoft 365 card. Click Connect — this redirects the client’s own Microsoft admin to grant consent; you never enter a tenant ID by hand.
2

Turn on the portal sign-in toggle

Still in the client’s context, open PSA → Support Portal (or click the Support Portal tile on the main Settings page) and find the Portal Single Sign-On (Entra ID) card. The toggle is disabled until a Microsoft 365 connection exists; once one does, switch it on.
There’s no separate “Authentication” tab or a field to type in a tenant ID for portal SSO — the Support Portal settings page is a single scrolling page of cards, and this one is just an on/off switch gated on the Microsoft 365 connection above.

​
SSO and MFA interaction

SSO does not blanket-skip Regentra’s own MFA — Regentra checks whether Azure AD’s sign-in response actually proves MFA happened (via the token’s authentication-methods claim), and only skips its own passkey or TOTP challenge when it can:
  • If Azure AD’s conditional access enforced MFA on that specific sign-in, Regentra treats that as satisfying its own MFA requirement and doesn’t re-prompt.
  • If Regentra can’t confirm the IdP performed MFA (Azure AD didn’t enforce it, or the proof is missing from the token), and this user still requires MFA — because of their role or your org’s MFA setting — Regentra falls back to its own passkey/TOTP challenge (or a trusted-device cookie, if you have one) after the SSO sign-in completes.
  • Admin-tier roles (Admin, Super Admin, MSP Admin) still always require MFA regardless of SSO, per Who needs MFA — SSO doesn’t exempt them, it can only satisfy the requirement when Azure AD’s own proof is strong enough.
For the strongest security posture, enforce MFA in Azure AD conditional access policies so SSO logins carry that proof and skip Regentra’s own prompt too. Regentra doesn’t have a setting to disable password-based login entirely once SSO is connected.

​
Account lockout

Repeated failed sign-in attempts on the email/password path lock an account for a short cooldown period regardless of whether SSO is also enabled for your organization — see Account lockout. SSO sign-ins go through Microsoft’s own login flow and aren’t subject to Regentra’s lockout, since Regentra never sees the password attempt.