Set up SSO in AdminPulse with Microsoft Entra ID and exclude specific users

With single sign-on (SSO), users sign in to AdminPulse using a Microsoft account. They no longer need a separate AdminPulse password.

AdminPulse supports both work accounts in a Microsoft Entra ID environment and personal Microsoft accounts, such as accounts using an @hotmail.com or @outlook.com address.

If you have the required access rights, you can configure SSO with Microsoft Entra ID (formerly Azure Active Directory or Azure AD) yourself in AdminPulse.

This article explains what changes when you enable SSO, how to enable or disable it, and how to exclude specific users.

Do you use Google or another SSO provider?

You can only configure SSO with Microsoft Entra ID yourself. If you use Google or another SSO provider, you cannot set up this sign-in method or change its settings yourself.

You can, however, disable the existing SSO configuration or switch to Microsoft Entra ID yourself. Before doing so, contact the AdminPulse support team by submitting a support ticket to discuss the available options.

What changes when you enable single sign-on?

When you enable SSO with Microsoft Entra ID:

• users sign in through Microsoft. The e-mail address of the AdminPulse user must match the e-mail address of the Microsoft account;
• these users can no longer sign in with their AdminPulse password or reset that password;
• two-factor authentication is managed in Microsoft Entra ID or, for a personal Microsoft account, in the security settings of that account;
• AdminPulse may ask users who are already signed in to sign in again.

👉 SSO applies to your whole organization, not just the company that is currently selected.

You can exclude specific users from mandatory SSO. Excluded users continue to sign in with their e-mail address and password. This can be useful for external consultants, interns, or temporary student workers who do not have a suitable Microsoft account with the same e-mail address as in AdminPulse.

Before you enable single sign-on

Keep the following points in mind before enabling SSO:

• Each user who signs in through SSO must have a valid Microsoft account. This can be a work account in your organization’s Microsoft Entra ID environment or a personal Microsoft account.
• Tell your users that after the switch, they must sign in through Microsoft instead of using their AdminPulse password.

Exclude users who cannot sign in through Microsoft during the configuration or through their employee profile.

💡 Before enabling SSO, check that the e-mail address of your own AdminPulse account matches the e-mail address of your Microsoft account. If the addresses do not match, exclude your account from mandatory SSO. Otherwise, you may no longer be able to sign in after the switch.

Enable or disable single sign-on

You manage the sign-in method through Settings > General settings > Security. Under Login method, you can see which method your organization currently uses.

👉 To change the sign-in method, you need Update rights for Settings. If you only have read access, you can view the setting but cannot change it.

Enable single sign-on

1. Go to Settings > General settings > Security.
2. Under Login method, click Configure.
3. Select Microsoft Entra ID.
4. Under Users excluded from single sign-on, select the users who must be able to continue signing in with their e-mail address and password. If needed, use the Search users field.
5. Click Save and confirm that you want to enable SSO.

From that moment, all non-excluded users sign in with their Microsoft account.

Disable single sign-on

1. Go to Settings > General settings > Security.
2. Under Login method, click Configure.
3. Select No single sign-on.
4. Click Save and confirm that you want to disable SSO.

All users will then sign in again with their e-mail address and AdminPulse password.

👉 Users who have never set an AdminPulse password can create one through Forgot password on the sign-in page.

Exclude users from single sign-on

Excluded users continue to sign in with their e-mail address and password. AdminPulse two-factor authentication still applies to these users if it is enabled.

Excluded users can still choose to sign in through SSO. Excluding them only removes the requirement to use SSO; it does not block this sign-in method.

You can exclude users in two ways:

• Through Settings > General settings > Security > Configure. In the Users excluded from single sign-on list, you can select several users at once. You need Update rights for Settings to do this.
• Through Settings > Employees. Open the employee profile and change the Login method field. You can also set the login method when creating a new employee. To change it in an existing employee profile, you need Update rights for Users.

💡 The Login method field only appears when your organization uses SSO.

When you change a user’s login method, their current session may not end immediately. AdminPulse signs the user out when their sign-in is checked again. The new method applies from their next sign-in.

View your employees’ login methods

In Settings > Employees, click Change columns and add the Login method column. This column is only available when your organization uses SSO.

The column shows the SSO provider used by each employee. For an excluded user, it indicates that no SSO is used. It remains empty for employees without an AdminPulse account.

Use two-factor authentication with SSO

For users who sign in with a Microsoft work account, two-factor authentication is managed in Microsoft Entra ID. For a personal Microsoft account, it is managed in that account’s security settings. If Microsoft requires additional verification, the user completes it on the Microsoft sign-in page.

👉 The two-factor authentication (2FA) settings in AdminPulse do not apply to these users. SSO does not automatically enable two-factor authentication. It depends on the security settings of the Microsoft account.

AdminPulse two-factor authentication still applies to users excluded from SSO. We recommend always requiring these users to use two-factor authentication.

To do this, enable All users should enable two factor authentication. under Settings > General settings > Security. This option requires all users who sign in with an AdminPulse password to set up two-factor authentication. Users who sign in through SSO are not prompted to enable it.

What if a user cannot grant permission to the AdminPulse app?

The information below applies to Microsoft work accounts managed through Microsoft Entra ID.

When a user signs in through SSO for the first time, Microsoft may ask for permission to use the Microsoft account in AdminPulse. Depending on the consent settings in Microsoft Entra ID, some users may not be allowed to grant this consent themselves.

If Do not allow user consent is enabled, the user sees the following error message:

Follow these steps:

1. Click the link in the error message.
2. Sign in with an account that has administrator permissions in Microsoft Entra ID. This account does not need to be used in AdminPulse.
3. Grant consent for the whole organization. Individual users will then no longer need to grant consent separately.

💡 Good to read

• To learn more about two-factor authentication, read Enabling Two-Factor Authentication (MFA): a step toward a more secure account.
• See also General settings.