With single sign-on (SSO), your colleagues sign in to Agentic Packr with their Microsoft Entra account. There is no separate password, and new colleagues get an account automatically on first sign-in.
Before You Start
- Any work account in your tenant can set up SSO if your tenant allows users to consent to apps.
- If your tenant blocks user consent, an admin (Cloud Application Administrator, Application Administrator, or higher) must grant consent once. See Grant Admin Consent below.
- SSO and the Intune connection share the same Entra app. Deleting the Splashtop Agentic Packr app in Entra breaks both. To remove only SSO, use Remove SSO in Agentic Packr.
-
Go to Settings → Integrations and click Configure on the Single Sign-On card.
-
Select Microsoft Entra ID (recommended) and click Connect Microsoft SSO.
-
Choose a work account for the tenant you want to connect and complete the password and MFA steps.
-
Confirm that the green success message appears. The card shows your domain, tenant ID, and who connected it.
Note: Advanced (any IdP) supports OIDC and SAML for Okta, Google Workspace, or your own app registration. Redirect URI: https://my.apps.splashtop.com/sso/callback. This option is not covered in this article.
Review the SSO Settings
Scroll down below the connection card. The defaults suit most organizations.
| Setting | What it does |
|---|---|
| Email Domains | Domains that can use SSO. Your domain is added automatically. Leave empty to allow any domain. |
| Enforcement Mode |
Optional (default): colleagues can
sign in with SSO or a password. Required: disables password sign-in for listed domains. Keep Optional until you have signed in with SSO at least once. |
| Just-In-Time (JIT) Provisioning | On by default. Creates an account and adds the colleague to your organization the first time they sign in with Microsoft. When JIT is off, colleagues must be invited first. |
| Default Role | Role for new JIT accounts: Viewer (default), IT User, Administrator, or Owner. Change roles later under Teams. |
-
If you changed anything, click Update Settings.
-
Click Test Connection. You should see Connection test successful!
Control Who Gets Access
| Configuration | Result for a new colleague |
|---|---|
| JIT on (default) | Signs in and gets access with the default role. |
| JIT off | Sees "Your account was not found" until you invite them. |
To invite someone, go to Teams → Users, click Invite User, enter their email, choose a role and a Sign-in method (single sign-on or password), and send. An invited SSO colleague gets the invited role at first sign-in. Colleagues who were denied access do not appear in the Users list until invited.
Note: Colleagues created through SSO have no Agentic Packr password. If you click Remove SSO or delete the enterprise app in Entra, they can no longer sign in. Invite them with the password method first, or make sure you can connect SSO again right away.
Grant Admin Consent (Only If Your Tenant Blocks User Consent)
If colleagues see "Need admin approval" from Microsoft, an admin fixes it once for everyone:
-
Click Grant admin consent on the SSO connection card.
-
Sign in with an admin account and click Accept.
-
Confirm that the message "Admin consent granted. Users can now sign in with Microsoft." appears.
On the login page, they select the Single sign-on tab, enter their email, and click Continue with single sign-on.
| Problem | Solution |
|---|---|
| "Need admin approval" when signing in | Your tenant blocks user consent. Ask an admin to click Grant admin consent. |
| "SSO Sign-In Failed. Your account was not found" | JIT is off. Invite the user under Teams → Users, or turn JIT on and click Update Settings. |
| SSO colleague cannot sign in after Remove SSO | Colleagues created through SSO have no password. Connect SSO again, or invite them with the password method. |
| Other sign-in errors | Check that the user's domain is listed in Email Domains and that they use an account from the connected tenant. |
| You want to start over or switch to Advanced (any IdP) | Click Remove SSO. This does not affect the Intune connection. |
Need more help?
When contacting Splashtop support, have your portal version (bottom
left of the menu, e.g., v1.1.0 build 493), organization name, and
tenant ID ready.