Set up single sign-on for your MSP

Your MSP can have its own single sign-on (SSO) connection, separate from the connections your clients set up. With it active, your staff enter their email on the Hook login page, continue to your identity provider, and land in the MSP portal with the same access to your clients as before. Your MSP doesn't need full migration for this.

You need the admin role in your MSP organization and someone who can create a SAML application in your identity provider.

Find your organization's connection

Go to Settings, then Single sign-on in your MSP workspace. Your own organization sits above the client list. Open it to set up or manage your MSP's connection. The client list below works as described in Monitor single sign-on across your clients.

Connect your identity provider

Setting up your MSP's connection follows the same steps as a client's:

1. Create the SAML application in your provider with the values on the Hook service provider details card. The provider-by-provider steps are in Create the application in your identity provider.
2. Assign your MSP's Hook admins to the application, and send each person's Hook email address. Hook matches admins by the address they were invited with, so an alias or a different domain is turned away.
3. Paste the metadata into Hook, open the connection for testing, and run a test sign-in in a private window, as in Run a test sign-in.
4. Activate the connection. Admin sign-in starts once it is active.

From then on your staff sign in as described in How admins sign in, and the Sign-in link for your organization works as a tile in your provider's dashboard.

Whose admins each connection signs in

A connection signs in only the admins of the organization that owns it:

• Your MSP's connection signs in your MSP's staff. It doesn't sign in your clients' admins.
• A client's connection signs in that client's admins and learners. Your staff never sign in through it, even when you manage the client.
• A Sub-MSP sets up its own connection for its own staff.

Signing in through your provider never makes someone an admin. Only people who already have the Admin role in your MSP in Hook can sign in through it.

Require SSO for your MSP's admins

Require SSO for admins on your MSP's connection makes your provider the only way your MSP's admins can sign in. It works exactly as it does for a client organization, including who can turn it on and what pauses it; see Require SSO for admins. To turn it on, use Sign in with SSO now on your organization's settings first, so Hook knows you can get back in through your provider.

If your provider fails while the requirement is on, ask support@hooksecurity.co for recovery access. Your staff can sign in with a code or password for a bounded window.

Clients that require SSO for their admins

A client's Require SSO for admins binds only that client's own admins. Your staff keep signing in under your MSP's settings and manage the client from the MSP portal as before.

You can turn a client's requirement off from their single sign-on settings, for example when their provider is down and their admins can't get in. Hook records that you made the change. You can't turn it on for them: only one of the client's own admins, signed in through the client's connection, can do that.

Related