If you haven't read it yet, Single sign-on (SSO): an introduction explains what single sign-on is and why it's worth doing.

Before you start

Your IT team needs to approve AdviceAid first. This is a one-off step, covered in Setting up single sign-on: for IT teams. Once that's done, you'll see your organisation listed as connected in AdviceAid.

Turn on sign-in with Microsoft

AdviceAid walks you through this in a short wizard. You can leave and come back, your progress is saved. AdviceAid won't let you make Microsoft sign-in compulsory until you've successfully tested it, so you can't accidentally lock your team out.

  1. Connect. Generate a connection link and send it to your IT team for approval (see "Before you start"). Once approved, the wizard shows your organisation as connected.

  2. Test sign-in. Select "Sign in with Microsoft" inside the wizard. AdviceAid checks whether the sign-in works and tells you why, if it doesn't. You need to see a successful result here at least once before you can move to the last step.

  3. Review. AdviceAid shows everyone currently in your team, and how each person will be recognised the next time they sign in with Microsoft. This is your chance to spot anyone who might be left out, before you switch it on for everyone.

  4. Make it compulsory (optional). Turn on enforced sign-in, covered below. You can also stop here and leave Microsoft sign-in as an option alongside passwords.

How AdviceAid recognises your staff

The first time someone signs in with Microsoft, AdviceAid matches them to their existing AdviceAid account using their email address.

After that, AdviceAid remembers their Microsoft account and uses it to recognise them every time. This keeps working even if their email address changes later. AdviceAid updates their stored email and name automatically to match Microsoft.

Make Microsoft sign-in compulsory (enforced sign-in)

By default, your staff can sign in either with Microsoft or with an AdviceAid password. Turning on enforced sign-in switches off passwords for your team completely, so Microsoft becomes the only way in.

When you turn this on:

  • Signing in with a password no longer works for anyone on the team.

  • Password reset and "change password" are switched off. There's no password to manage.

  • If someone's access is removed in Microsoft, for example because they've left, this takes effect quickly in AdviceAid too.

You can turn this off again at any time. If you do, password sign-in comes back. Anyone added while it was on won't have a password yet, so they'd need to reset one to use it.

New starters: setting up accounts automatically

Normally, a new member of staff needs an AdviceAid account created for them before they can sign in. You can turn on automatic account creation so that anyone your IT team has approved gets an AdviceAid account the moment they first sign in with Microsoft.

Here's how the two pieces fit together:

  1. Your IT team gives the new starter access to AdviceAid in Microsoft. This is the step that decides who's allowed in.

  2. You turn on automatic account creation in AdviceAid's sign-in settings.

  3. The first time that person signs in with Microsoft, AdviceAid creates their account automatically. They start with the Adviser role.

  4. You then set their correct role. See Adding new users for what each role can do.

If automatic account creation is switched off, a new starter who's been approved by IT still can't use AdviceAid until you invite them, as in Adding new users.

This works well for teams adding a handful of new people at a time. If your team has a lot of starters and leavers, let us know and we can talk through options.

Managing your team day to day

  • Adding people manually. This still works exactly as before, and is the right approach if automatic account creation is off, or for one-off additions. See Adding new users. If your team has enforced sign-in switched on, anyone you invite signs in with Microsoft straight away. They don't set a password.

  • Roles. Roles are always set inside AdviceAid, whether or not someone signs in with Microsoft. Signing in with Microsoft never changes anyone's role.

  • Removing access. To stop someone signing in, remove their access in Microsoft (your IT team can help with this), and remove their AdviceAid account if you no longer need it. If your team has enforced sign-in switched on, removing their Microsoft access is what stops them signing in.

What to read next