Entra SSO with your Tenant

In this page we will discuss the option of authenticating users with Turbo360 using your Entra ID tenant for SSO and then adding guest users from other tenants.

The process for this is as follows:

1. You setup a Turbo360 account and convert it to use SSO

2. When setting up SSO you use a Global Admin to configure consent for your tenant

3. You can then add users from your tenant to Turbo360 accounts

4. You can add users from other tenants to your tenant as guest users and then you can also grant them access to your Turbo360 accounts which are linked to your tenant

   This is shown in the below diagram:

Authentication Scenarios

We will now go through an example of some authentication scenarios.  

Authentication by one of your companies Users

When a user from your company with the domain your-csp.com logs into Turbo360 they will complete the Turbo360 login screen like below.

Your user is then redirected from Turbo360 to your Entra ID login page.

Your user will then provide the normal Entra ID authentication with username and password from Entra and any MFA/Conditional access policy you have in place.

Once successfully authenticated the user is returned to Turbo360 and they will have access to any Turbo360 accounts they are authorized to access.

Authentication by one of your customer users

In the scenario where you want one of your customers to log into Turbo360, you will have added them to your Entra ID tenant as a guest user.

The user will then add the authentication details as shown below.

The key difference here is that they supply their normal email, but they will use YOUR domain as the entra domain.

At this point they will be directed to your Entra tenant where they will then be federated from your tenant to their home tenant.

They will then see their normal Entra ID authentication page on their tenant and follow any MSP policy implemented on their home tenant.

Once authentication is complete they will be returned to Turbo360 as an authenticated user and will then have access to any accounts they belong to.

The below diagram shows this flow.

Questions

1. Can I use Groups

Yes, this is the recommended approach, add groups to entra with your users and customer users in them and then add these groups to Turbo360.  This means you can just add a user to the group to provide permission to Turbo360.

Pros

• Your Users

  • Authenticate against your tenant

  • Use any MFA and Conditional access

  • Uses your Password policy

• Customer Users

  • Authenticate against home tenant

  • Use any MFA and Conditional access

  • Uses your Password policy

Cons

• Some CSP do not like to have guest users in their tenant

  • In this scenario please refer to the Proxy Tenant approach in this section.