User access
Single sign-on and linked sign-in methods
How Sign in with Microsoft and Google work, why a provider sign-in does not by itself find your account, and how to link or unlink a method from Settings.
Updated September 5, 2026 | 5 min
What SSO does and does not do
SSO is an authentication method only. Your tenant and your role always come from your ITDR user record, never from the identity provider.
It is completely separate from the Microsoft connector. Signing in with Microsoft creates no connector and grants ITDR no access to your tenant data.
The provider proves who you are; ITDR then issues exactly the same session it would have issued for a password sign-in.
Buttons only appear for providers the deployment has configured. If a provider is not set up, its button is hidden.
Link a sign-in method
- Sign in to ITDR with your email and password.
- Open Settings and find the Linked sign-in methods section.
- Choose Link next to Microsoft or Google. You are sent to that provider to confirm.
- You return to Settings and the provider is listed as linked, showing the address it was linked with.
- From then on you can sign in with either that provider or your password.
Unlink a sign-in method
- Open Settings and find Linked sign-in methods.
- Choose Unlink next to the provider you want to remove.
- If it is your only way in, ITDR refuses and tells you so. Set a password first, then unlink.
Why a provider sign-in does not simply find your account
Signing in with a provider does not find an existing ITDR account by matching the email address, unless the provider has proven that address belongs to you.
Google states whether an address is verified, so a verified Google address is trusted to identify an existing account.
Microsoft work accounts do not always attest the email claim. Any Entra tenant can put any address on a user, so trusting it would let an outsider claim your account by choosing your address.
When the address is not proven, ITDR refuses and asks you to sign in with your password and link the method from Settings, which is the deliberate, authenticated version of the same action.
If sign-in is refused
unlinked_account: no ITDR account is linked to that sign-in, and the address was not proven. Sign in with your password and link it from Settings, or redeem an invite.
identity_taken: that provider account is already linked to a different ITDR user. Unlink it there first.
no_account: there is no ITDR account for you yet. Ask an administrator for an invite; SSO never creates a brand-new tenant on its own.
session: the sign-in completed but the session could not be established. Try again, and check that cookies are allowed for this site.
Administrator notes
Providers are enabled per deployment by configuring their OAuth client credentials. Until then the login page shows no SSO buttons and the endpoints return 404.
Microsoft user sign-in uses its own app registration, entirely separate from the Microsoft connector app that reads tenant data.
Linking, unlinking and every SSO sign-in are recorded as audit events and are visible under Settings, Audit log.
Provisioning policy is invite-only. A provider sign-in can create an account only when it is redeeming a valid invite that matches the address.