Let your users sign in to myAvail ETMS with the Microsoft account they already use for work. This guide walks your IT administrator through everything Avail needs to turn on single sign-on (SSO) and how to roll it out.
NOTE: This guide is for administrators. Share the ETMS SSO User Guide with your end users.
Overview
ETMS supports single sign-on with Microsoft Entra ID (formerly Azure AD). Your users sign in to ETMS with their existing organization Microsoft account instead of a separate ETMS password.
Sign-in happens in your own Microsoft tenant, so your existing security policies, including multi-factor authentication (MFA) and Conditional Access, apply to every ETMS sign-in.
How it works
Your users authenticate only with Microsoft, in your tenant. ETMS never sees their password. It receives a signed token, confirms it came from your tenant, and matches the user to their ETMS profile by email or UPN.
1 |
User selects Login with Azure on the ETMS login page. |
2 |
ETMS redirects the user to your organization's Microsoft sign-in page. |
3 |
Your Microsoft tenant checks the password, MFA, and your Conditional Access policies. |
4 |
Your tenant returns a signed token to ETMS containing the user's name and email. |
5 |
ETMS confirms the token came from your tenant ID and matches it to the user's profile email. |
6 |
User is signed in to ETMS. |
Before you begin
- A Microsoft Entra ID tenant. Any Microsoft 365 or Azure subscription includes one. The free Entra ID tier is sufficient.
- An administrator who can grant consent to applications. One of these roles is required: Global Administrator, Cloud Application Administrator, or Privileged Role Administrator.
What we need from you
Send the following to your Avail contact or Avail Support.
- Your Directory (tenant) ID. In the Microsoft Entra admin center, go to Identity > Overview and copy the Tenant ID. ETMS uses it to accept sign-ins only from your organization.
- Your sign-in identifier: email or UPN. ETMS matches each user by either their email address or their User Principal Name (UPN, the name they sign in to Microsoft with). If these are the same for your users, choose email. If they differ, tell us which one your users' ETMS profiles should match.
- A technical contact for setup questions and testing.
TIP: Email or UPN? Run this in Microsoft Graph PowerShell to list users whose email differs from their UPN. No results means email is the right choice.
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -All -Property UserPrincipalName,Mail |
Where-Object { $_.Mail -and $_.Mail -ne $_.UserPrincipalName } |
Select-Object UserPrincipalName, MailGrant admin consent
After we configure your environment, Avail sends you a consent link. An administrator from your organization opens the link, signs in, and selects Accept. This is a one-time step for your whole organization.
ETMS requests only the Microsoft Graph delegated permissions below. Delegated means ETMS acts only as the signed-in user, never as an application with its own access.
| Permission | Type | Shown on consent screen as | Why ETMS needs it |
|---|---|---|---|
openid |
Delegated | Sign users in | Signs the user in with Microsoft |
profile |
Delegated | View users' basic profile | Reads the user's name |
email |
Delegated | View users' email address | Matches the user to their ETMS profile |
User.Read |
Delegated | Sign in and read user profile | Standard Microsoft sign-in permission |
offline_access |
Delegated | Maintain access to data you have given it access to | Keeps the user signed in during their session without repeated prompts |
NOTE: ETMS does not request access to your directory, mail, files, or other data. Microsoft does not require admin consent for these permissions, but granting it once for the organization means users are not prompted individually. It is required if your tenant blocks user consent.
After consent: the ETMS enterprise application
Consent adds an application named ETMS SSO followed by your organization's name (for example, ETMS SSO PSTA) to your tenant under Entra admin center > Enterprise applications. This is your organization's copy of the app, and you manage it like any other enterprise application.
From it you can:
- Target ETMS with Conditional Access policies.
- Require assignment and choose which users or groups can sign in.
- Review or revoke the permissions you granted.
- View sign-in logs for ETMS.
- Turn off sign-in for all users with Enabled for users to sign in? under Properties.
IMPORTANT: Avail manages the app's sign-in settings, such as its address and requested permissions. Deleting the enterprise application stops SSO until an administrator grants consent again.
Configure the ETMS enterprise application
All settings below are in your tenant and fully under your control. Avail cannot see or change them.
Require MFA with Conditional Access (recommended)
Requires Entra ID P1 or higher. Without P1, turn on Security Defaults instead, which requires MFA for all users and apps.
- Go to Entra admin center > Protection > Conditional Access > Create new policy.
- Users: All users, or the group that uses ETMS.
- Target resources: Select resources > ETMS SSO.
- Grant: Require multifactor authentication.
- Enable policy: Report-only first. Review the results in the sign-in logs, then switch to On.
TIP: If you already have a policy that requires MFA for all resources, ETMS is covered and no new policy is needed.
Limit who can sign in (optional)
- Go to Enterprise applications > ETMS SSO > Properties.
- Set Assignment required? to Yes and select Save.
- Go to Users and groups > Add user/group and assign who should have access. Assigning groups requires Entra ID P1.
Turn off SSO for everyone
In Enterprise applications > ETMS SSO > Properties, set Enabled for users to sign in? to No. Users can still sign in with their ETMS password.
Monitoring sign-ins
ETMS sign-ins appear in your tenant's sign-in logs like any other application.
- Go to Monitoring & health > Sign-in logs and filter by Application ID, using the Application ID shown on the ETMS SSO enterprise application. Filtering by name can miss sign-ins logged before the application was renamed.
- Check both User sign-ins (interactive) and User sign-ins (non-interactive). A user already signed in to Microsoft in their browser is not prompted again, so that sign-in is logged as non-interactive.
- The Resource column shows Microsoft Graph for ETMS sign-ins. This is expected.
- Each entry shows the user, result, MFA details, and any Conditional Access policies applied. Entries can take a few minutes to appear.
- Failed sign-ins include an error code. See Troubleshooting below.
Troubleshooting
| Error | Meaning | Fix |
|---|---|---|
AADSTS65001 |
Consent has not been granted | An administrator completes the consent link from Avail |
AADSTS90094 |
Admin approval required (user consent is blocked in your tenant) | Grant admin consent |
AADSTS50105 |
User is not assigned to ETMS | Assign the user or their group, or set Assignment required? to No |
AADSTS53003 |
Blocked by Conditional Access | Review the policy listed in the sign-in log entry |
AADSTS7000112 |
ETMS sign-in is disabled in your tenant | Set Enabled for users to sign in? to Yes |
AADSTS50011 |
Redirect address mismatch | Contact Avail Support |
| Microsoft sign-in succeeds, but ETMS does not sign the user in | The user's ETMS profile email does not match their Microsoft email or UPN | The user updates their ETMS profile email |
For anything else, send Avail Support the error code, the time of the attempt, and the Correlation ID from the sign-in log entry.
Rolling out to your users
Existing ETMS usernames and passwords keep working after SSO is enabled, so you can roll out SSO gradually.
- Pilot. Have a test user, or a small group, follow the user guide and confirm sign-in works.
- Announce. Send users Signing In to ETMS with Your Microsoft Account. Each user updates the email on their own ETMS User Profile to match their Microsoft email (or UPN, if you chose UPN), then signs in with Microsoft.
- Monitor. Watch your Entra sign-in logs for the ETMS SSO application during the first week for failures.
NOTE: Users whose profile email does not match cannot sign in with SSO until they correct it. They can still use their ETMS password in the meantime.
Frequently asked questions
Does Avail get access to our directory?
No. ETMS only receives the signed-in user's basic profile and email address at sign-in.
Whose MFA policy applies, ours or Avail's?
Yours. Users authenticate against your tenant, so your MFA and Conditional Access policies apply.
Do we need a paid Entra ID license?
No. The free tier is sufficient. Some features, such as Conditional Access, require Entra ID P1 or higher.
Do users need a new password?
No. They sign in with their existing Microsoft account.
How do we turn SSO off?
Contact Avail Support. You can also disable the ETMS SSO enterprise application in your tenant at any time.