CloudOneTechnologies
Book a demo
Menu

Single sign-on and MFA

Connect your identity provider once in My Apps with OIDC or SAML, verify your domains, and require multi-factor authentication.

Updated 2 November 2026

Online version, always current: https://cloudone.tech/docs/platform/single-sign-on/

Single sign-on is set up once for your whole organization, in My Apps (the CloudVision360 portal). Every product then signs your people in with “Sign in with CloudVision360”, so there is nothing to configure in the individual products.

One sign-in for every product

People sign in once and open every product they use from My Apps. Each product signs them in with “Sign in with CloudVision360” and gives them the role you assigned in My Apps. Their account in the product is created the first time they open it. The All apps button at the bottom of each product’s icon rail switches between products.

Connect your identity provider

  1. In My Apps, open SSO in the left rail and choose Add identity provider: Microsoft Entra ID, Google Workspace, Okta, any OpenID Connect provider, or SAML 2.0.
  2. In your identity provider, create an application with the redirect (callback) URL, or the SAML service-provider metadata, that My Apps shows.
  3. Paste the issuer URL, client ID and client secret (OIDC), or the IdP metadata (SAML), back into My Apps and test the sign-in.
  4. Under Verified domains, prove your email domain with a DNS TXT record and set Signs in with to the new connection.

The administrator guide walks through each step.

Roles

Give people access to each app, and their role in it, in My Apps → People. The role is applied at every sign-in, so changing or removing it in My Apps changes access the next time the person opens the app. ITOps360 can also map Active Directory groups to roles for people who sign in with their domain account.

Multi-factor authentication

My Apps always requires a second factor: its own authenticator code, or your identity provider’s MFA when you choose to trust it. The products record how each session was authenticated, so high-risk actions can ask for a fresh check.

Enforce

Once tested, set single sign-on to required for your domain so passwords are no longer accepted. The break-glass administrators you choose keep a password and authenticator sign-in to My Apps.

Each product also keeps a few local break-glass accounts (its own password and authenticator, at the product’s /login?local=1) for the rare case that My Apps can’t be reached. They are created by the product’s administrators under its users page, and they are the only accounts with a product password.