Single Sign-On (SSO)

Let users sign in to Connectware with a single set of credentials via Microsoft Entra ID or LDAP.

With single sign-on (SSO), Connectware delegates authentication to your organization's identity provider. Users log in with their existing corporate accounts instead of a separate Connectware password, and Connectware creates or updates a local user for them on first login.

When to Use SSO

SSO makes sense when:

• Your organization already has a central identity provider (Microsoft Entra ID, Active Directory, or an LDAP-compatible directory).

• You want to enforce your organization's existing password policies and account lifecycle management centrally.

• Users should not need a separate Connectware password.

• You need to automatically provision or revoke access when someone joins or leaves a team.

Local username/password accounts remain available alongside SSO. You can run both at the same time — for example, keeping a local admin account as a fallback while all other users authenticate through SSO.

Connectware's built-in multi-factor authentication is available for local and LDAP users, but not for Microsoft Entra ID users. For Entra ID, enforce MFA at the identity provider instead.

Choosing a Provider

Connectware supports the following SSO providers:

Provider	Best for
Microsoft Entra ID	Organizations using Microsoft 365 or Azure Active Directory
LDAP	Organizations with an on-premises Active Directory or OpenLDAP directory

Both providers support automatic role assignment — you map identity provider groups to Connectware roles, so access is granted and revoked automatically based on group membership.

How User Accounts Work with SSO

When a user logs in through SSO for the first time, Connectware creates a local user account for them automatically. On each subsequent login, Connectware synchronizes their role assignments from the identity provider.

SSO users appear in the Users View alongside local users. Their roles are managed through the identity provider — you cannot change their roles from within Connectware while SSO is active.

If you remove an SSO user from the identity provider, they can no longer log in. Their local Connectware user account remains but is effectively locked out. You can delete the local account from the Users View if needed — this only removes the local record and does not affect the identity provider.