Set up single sign-on with Microsoft Entra

If your company uses Microsoft 365, your people can sign in to ProjectSmith with the work account they already use for Outlook and Teams. Your organisation’s own multi-factor authentication, Conditional Access policies and account lifecycle then apply: when IT disables someone’s Microsoft account, they can no longer sign in to ProjectSmith either.

Only the workspace Owner can set this up, in Settings → Single sign-on. It takes about two minutes.

What you need

To be the workspace Owner.
A Global Administrator or Privileged Role Administrator of your organisation whose own account belongs to your directory: not a guest, and not a partner (GDAP) admin signing in from another company. If the role is eligible through Privileged Identity Management, activate it first. This can be you.

ProjectSmith asks Microsoft only to sign people in and read their name and email address. It gets no access to mail, files or anything else in Microsoft 365, and holds no password or secret for your organisation.

Connect your organisation

Go to Settings → Single sign-on and choose Connect Microsoft Entra.
Step 1, approve. Choose Open the approval page. Your Entra admin signs in to Microsoft and approves ProjectSmith for the organisation. If your admin is someone else, choose Copy link for your Entra admin and send it to them; the link works for one hour. When they approve, Microsoft shows them a short “Approved” page.
Step 2, verify. Back on the Single sign-on page, choose Verify. A Microsoft sign-in window opens: the Entra admin signs in once. If the admin is not you, they sign in on your screen (sitting with you or over a screen share).
The page shows Connected, with your organisation’s directory (tenant) ID.

Why two steps: the approval tells Microsoft that your organisation trusts ProjectSmith; the verification proves to ProjectSmith which organisation that was. ProjectSmith links your workspace to the directory it reads from that verified sign-in, never from the address of a web page, so nobody can attach someone else’s directory to a workspace. One Microsoft directory can be connected to only one ProjectSmith workspace.

On the ProjectSmith sign-in page they choose Sign in with Microsoft (work account) and sign in as usual.

People you invited who have not signed in yet: the first time, ProjectSmith matches them to their invitation by their verified work email address (Microsoft confirms your organisation owns the domain). After that first sign-in they are recognised by their Microsoft account itself, so a later change of email address does not matter.

People who already sign in with their email address link their work account once: they sign in with email, open My preferences and choose Link my Microsoft account, which takes them to Microsoft. ProjectSmith never attaches a Microsoft account to an existing user on its own, so nobody can take over someone else’s user just by having a matching address.

Guests in your directory can accept an invitation this way, but cannot link to a user who already signs in by email.

Someone from your organisation who has not been invited sees “Ask your workspace admin to invite you”. ProjectSmith never creates users on its own.

By default people can still sign in with their email address and a one-time code, which suits contractors without a Microsoft account in your organisation. To make Microsoft the only way in, turn on Require Microsoft sign-in. Email sign-in to this workspace is then refused, so your MFA and Conditional Access always apply.

You can only turn it on while you are signed in with your own work account. That proves Microsoft sign-in works for you before email sign-in is switched off, so you can’t lock yourself out. Turning it off is always allowed.

Disconnect

Choose Disconnect on the Single sign-on page. Microsoft sign-in stops at once, “Require Microsoft sign-in” turns off, and everyone signs in with their email address again. If you connect again later, invitations are matched by email again and people who already sign in by email link their work account again from My preferences.

To remove ProjectSmith from your organisation completely, your Entra admin can also delete the ProjectSmith Sign in with Microsoft enterprise application in the Microsoft Entra admin centre.

Common questions

Is this recorded? Yes. Connecting, disconnecting, turning the requirement on or off, and each person’s first Microsoft sign-in are written to the workspace’s audit log.

Our admin approved, but Verify refuses their account. The person who signs in at Verify must be a Global Administrator or Privileged Role Administrator at that moment, with an account that belongs to your own directory (a guest or partner admin is refused). Activate an eligible role and choose Verify again.

Verify says our directory is already connected to another workspace. One directory connects to one workspace. That workspace’s Owner can disconnect it in Settings → Single sign-on. If nobody there can (for example the Owner has left), contact ProjectSmith support: after checking with you, they can release it, and that is recorded in that workspace’s audit log with the reason. A directory held by a workspace that was cancelled is released automatically once that workspace’s retention period has ended.

We turned on Require Microsoft sign-in and now nobody can get in. Turn it off in Settings → Single sign-on if any Owner can still sign in with Microsoft; otherwise contact ProjectSmith support, who can allow email sign-in again.

Verify says the request expired. The connection request lasts one hour. Choose Start again; an approval already given still counts.

Someone left the company. Disable their Microsoft account as usual and deactivate them on the Users page so their seat is freed. If “Require Microsoft sign-in” is off, deactivating them in ProjectSmith is what also stops email sign-in.