Access, authentication and single sign-on

For the bigger picture, start with AdviceAid security and compliance: start here.

This applies to your staff using the Compose back office. SelfServ, the public advice experience, has no logins at all, so resident authentication does not apply. See the out-of-scope note below.

Signing in with single sign-on

AdviceAid supports single sign-on (SSO) with Microsoft Entra ID. Your staff sign in with the Microsoft account they already use for work, and there is no separate AdviceAid password to manage.

Your IT team approves the connection once, and a team administrator then turns sign-in with Microsoft on for your users. You can run SSO alongside the old sign-in method while you test it, then enforce sign-in with Microsoft for everyone when you are ready. Once enforced, the AdviceAid password sign-in is switched off and all access goes through your identity provider.

Full setup detail is in these articles:

• Single sign-on (SSO): an introduction

• Setting up single sign-on: for IT teams

Multi-factor authentication

When you enforce SSO, every sign-in to AdviceAid goes through your own identity provider. That means your organisation's own multi-factor authentication and conditional access policies apply to AdviceAid automatically, the same as they do for your other Microsoft work tools.

This is the approach most councils prefer. Rather than AdviceAid running a separate, second MFA system, your existing controls govern who can sign in, from where, and on what device. When you strengthen your own policies, AdviceAid is covered straight away.

User roles and permissions

AdviceAid uses three roles, so people get the access their job needs and no more:

• Advisor can find and use advice.

• Author can also write and manage advice content.

• Admin can also manage user accounts.

Managing user accounts

• An Admin account, defined by your council, can add, view, amend and delete user accounts.

• With SSO, new starters can be given access as soon as your IT team sets them up with a Microsoft account.

• When someone leaves, switching off their Microsoft account removes their access to AdviceAid. There is no separate step to remember.

• Where the password sign-in is still in use, password resets are carried out by the user.

Day-to-day user management is covered in Setting up single sign-on: for team administrators.

How passwords are handled

Where a password is used (before SSO is enforced), passwords are encrypted using industry-standard methods. Once you enforce SSO, there is no AdviceAid password to store, because authentication is handled entirely by your identity provider.

Audit and access logs

AdviceAid keeps access logs and a record of administrative actions. Audit and access logs can be provided to your council on request.

How Neatlines staff access the service

Administrative access to the AdviceAid platform is limited to a small number of named Neatlines staff. We apply:

• Least-privilege access to cloud infrastructure, managed through identity and access management (IAM) controls.

• Multi-factor authentication on the managed services used to administer the platform.

• Privileged access management, with administration carried out from trusted devices and suitable audit information available for checking unexpected activity.

What is out of scope here

SelfServ has no resident accounts or sign-in, so resident authentication and resident MFA do not apply. See the out-of-scope list in AdviceAid security and compliance: start here.

Who to contact

For questions about access, authentication or single sign-on, contact Peter McGuire at peter.mcguire@adviceaid.uk