Entra SSO with a Proxy Tenant

In this approach, you as the CSP customer have decided that you do not want to add all of your customers as guest users to your Tenant, however you do want to take advantage of all of the benefits that Entra ID SSO offers.

In this case we can create a new Entra ID tenant which is separate to your main tenant.  We will tall this the “Proxy Tenant” for the purposes of this article.

You would add any users from your organization and any users from your customer organizations that you want to give access to Turbo360 to this proxy tenant as guest users.

You would then setup authentication with SSO for any Turbo360 accounts you have to use SSO against this proxy tenant.

The below diagram shows what this looks like.

Authentication by one of your companies Users

When a user from your company wants to log in they would complete the details below.

The login screen would redirect the user to the proxy Entra ID tenant.  That tenant would identify the user is a guest user and forward the user to their home tenant, which in this case is your companies tenant.

The user would then authenticate against your Entra ID tenant and then if successful they would be returned back to Turbo360 as an authenticated user.

The below diagram shows this flow.

Authentication by one of your customer users

When one of your customers login, they would provide the proxy Entra ID tenant as the domain name, and their own email address.

Turbo360 would then forward them to your proxy Entra ID tenant.

The proxy tenant would then forward them to their home tenant where they would authenticate.

They would then be returned back to Turbo360 as an authenticated user.

The below diagram shows this flow.

Questions

1. Can I use groups in the proxy tenant

Yes this is recommended and those groups are added to Turbo360 and given permissions.  This reduces the need for any users to be setup in Turbo360.

Pros

• Benefits of Entra ID SSO

• Removes the need for customers as guest users in your main tenant

Cons

• Adds an extra hop.  This comes into play during setup but once in place is transparent

• Guest users need to be added to proxy tenant