Enterprise SSO: managing user permissions in Microsoft Entra

Before you start

• Your organization is on the Enterprise plan (the Single sign-on & roles card on the Team page shows an Enterprise badge).
• Someone with an Entra role that can manage enterprise applications: Cloud Application Administrator, Application Administrator or Global Administrator.
• Entra ID P1 or P2 to assign groups. Assigning individual users works on any plan.
• You are an Owner in M365Assessments and sign in with an account from your organization’s own tenant.

How it works

• Every sign-in from your tenant follows your Entra assignments. Joiners get access without an invitation; leavers lose it when you remove the assignment or disable the account.
• Someone with several assignments (for example through two groups) gets the highest role.
• No SAML or SCIM setup is involved: it works with the normal “Sign in with Microsoft”.

Step 1: Assign roles in Microsoft Entra

1. In the Microsoft Entra admin center, go to Enterprise applications and open M365Assessments (the app your people sign in with; it appeared when the first person signed in).

2. Open Properties, set Assignment required? to Yes and select Save. Now only assigned people can sign in.

3. Open Users and groups, select Add user/group, choose a group (or user) and the role (Owner, Admin, Member or Viewer), then Assign. Start by assigning yourself as Owner.

Step 2: Turn it on in M365Assessments

1. Sign out of M365Assessments and sign back in, so your new role is part of your sign-in.

2. Go to Team › Single sign-on & roles. Under Test my role, check that your sign-in shows M365A.Owner → Owner.

3. Under Before you turn it on, tick that “Assignment required?” is set to Yes on the M365Assessments enterprise application. and the confirmation that members from your tenant keep access only with an app role.

4. Choose Signed in without a role: No access (recommended) or Viewer access (Viewer only matters if you leave Assignment required off). Optionally add Linked tenants.

5. Select Turn on single sign-on, then Turn on to confirm. The card shows Roles follow Entra ID.

What changes when it’s on

• People from your tenant get their role from Entra at every sign-in. Their rows on the Team page show Managed in Entra ID; change their assignment in Entra instead.
• Current members from your tenant without an assignment lose access at their next sign-in (or get Viewer, if you chose Viewer access).
• Changes apply at the next sign-in or token refresh, usually within an hour. Signing out and back in applies them immediately.
• Every change made by the sync is recorded in your organization’s audit log.

Guests, partners and linked tenants

• People from other organizations (guests, partners, contractors) sign in from their own tenant, so your assignments don't apply to them. Keep using invitations for them (Inviting teammates).
• Inviting an address from your own tenant is refused with a hint to assign a role instead.
• If your organization has a second Microsoft 365 tenant, add its tenant ID under Linked tenants. It's accepted once an Owner or Admin of your M365Assessments organization has signed in from that tenant.

Turning it off

Owners can select Turn off at any time. Everyone keeps the role they have right now, and roles are managed on the Team page again. The same happens if your organization leaves the Enterprise plan.

Troubleshooting