Microsoft Entra ID SSO

Single sign-on for lynes, built on Microsoft Entra ID

Microsoft Entra ID SSO is a single sign-on integration that lets your users log into lynes using their existing Microsoft account. No separate lynes password to manage, no additional credentials to remember. Users authenticate once through Microsoft and go directly to work.

The feature is built on top of lynes Entra ID Sync, so if you already use Entra ID Sync for user provisioning, enabling SSO is a configuration step rather than a migration project.

How does Microsoft Entra ID SSO work in lynes?

Microsoft Entra ID SSO works by routing the lynes login through Microsoft's identity service. When SSO is enabled, the lynes login page shows a sign-in option that redirects users to Microsoft for authentication. After verifying their Microsoft credentials, users land directly in lynes without entering a separate password.

Because authentication runs through Microsoft Entra ID, your existing Azure policies apply automatically. This includes any conditional access rules, MFA requirements, or device compliance checks you already have in place. lynes does not sit outside these controls.

Who controls the SSO settings?

Administrators manage SSO directly from the Entra ID Sync settings in the lynes admin panel. No support ticket required, and no coordination with lynes needed to make the change. The setting can be toggled for the entire organization in one step, or enabled per user for a more gradual rollout.

Once org-wide SSO is active, users signing into lynes are routed through Microsoft authentication by default. There is no separate switch to configure per feature or per application area within lynes.

What does Microsoft Entra ID SSO mean for IT security?

Every separate set of credentials is a separate attack surface. SSO reduces that exposure by centralizing authentication through the identity provider your IT team already manages. Fewer passwords means fewer opportunities for credential-based attacks, phishing, and account sprawl across your organization's tools.

Onboarding and offboarding also become more straightforward. A new employee provisioned through Entra ID Sync gets access to lynes as part of the same process. When an employee leaves, disabling their Microsoft account is enough. Access to lynes is revoked as part of the same action, with no separate step required in the lynes admin panel.

Org-wide or per-user activation

Some organizations want to enforce SSO for everyone from day one. Others prefer to test it with a smaller group before rolling it out. lynes supports both approaches from the same settings panel.

Enabling SSO per user first lets you verify the login experience and catch any edge cases before committing to org-wide activation. Switching to org-wide later is a single configuration change in the same Entra ID Sync settings panel, with no migration or re-authentication required for users already on SSO.

Requirements

• An active lynes Entra ID Sync integration is required before SSO can be enabled
• SSO is configured from the Entra ID Sync settings in the lynes admin panel
• Existing Microsoft Entra ID policies including MFA and conditional access apply automatically
• No additional lynes licence is required to use the feature

Frequently asked questions about Microsoft Entra ID SSO

What is Microsoft Entra ID SSO in lynes?

Microsoft Entra ID SSO is a single sign-on integration that allows users to log into lynes using their Microsoft account. It is built on lynes Entra ID Sync and can be enabled for the entire organization or for individual users, directly from the Entra ID Sync settings in the lynes admin panel.

Do I need Entra ID Sync before enabling SSO?

Yes. Microsoft Entra ID SSO in lynes is built on top of Entra ID Sync. The SSO setting lives inside the Entra ID Sync configuration, so the integration must be active before SSO can be turned on. If Entra ID Sync is not yet set up, that is the starting point.

Can I enable SSO for some users and not others?

Yes. Administrators can enable SSO per user from the Entra ID Sync settings panel. This makes a phased rollout straightforward. When you are ready to extend SSO to the whole organization, switching to org-wide activation requires a single configuration change in the same panel.

What happens to lynes access when a Microsoft account is disabled?

When a user's Microsoft account is disabled or removed in Entra ID, their ability to log into lynes via SSO is immediately revoked. If the user was also provisioned through Entra ID Sync, their lynes account is deprovisioned according to the sync settings. No separate action is required in lynes.