Admin Portal authentication

The Admin Portal is what you, the Organization administrator, sign in to. Open Admin Access Control → Authentication in the Organization left navigation to see the two methods available and toggle each one on or off.

Form Login (default)

Email and password against the platform’s identity store. Always on by default — the Form Login card on the Authentication page shows Enabled with the toggle disabled, because Form Login is the platform’s baseline authentication method.

A few useful properties of Form Login:

• It works the day you provision the Organization, before you’ve set up federation. Your first invitation email contains a link that lets the new administrator set their password and sign in.
• It can be hardened with Mandatory Email MFA in Organization Settings. Once on, every Form Login attempt requires a one-time code emailed to the user before completing sign-in.
• It is the break-glass path when SAML federation breaks (expired IdP cert, IdP outage, mis-configured role mapping). Keep at least one Organization Owner who can use Form Login when the rest of the team relies on SAML.

SAML 2.0

With SAML 2.0, administrators sign in to the Admin Portal with their account in your identity provider (IdP). Any IdP that supports SAML 2.0 can be used. Click Enable on the SAML 2.0 card to open the configuration page.

The configuration page is the same for the Admin Portal and the Self-Service Portal, and is described field by field in SAML configuration. What is specific to the Admin Portal:

• Roles. Every administrator who signs in through SAML gets the Default Role Mapping, unless your IdP sends a role that matches a Custom SAML Role Mapping. Tick at least one default role; Organization Member gives view-only access. See Admin Portal roles.
• Automatic accounts. A user who signs in through SAML for the first time is added to Administrators with the source SAML, without an invitation.
• No platform MFA. SAML sign-in does not ask for Mandatory Email MFA; multi-factor authentication is handled by the IdP.
• Turning it on. The switch is Enable SAML 2.0 Admin Dashboard Authentication in section 5. Once it is on, the sign-in page shows a SAML button next to Form Login.

How the sign-in works, and the IdP setup, are described in How SAML works and Microsoft Entra ID.

Saving and verification

After saving, sign in once via SAML from a private window or a secondary browser, while staying signed in via Form Login in your main session. If something is misconfigured, you can fix it without losing access. Common problems and fixes are covered in Organization diagnostics.

Break-glass access

Even with SAML enabled, always keep at least one Organization Owner who can sign in via Form Login. The reason is mechanical: the only way to fix a broken SAML configuration is to sign in as an Organization Owner and edit it. If the only Owner relies on SAML and SAML is broken, no one can fix it.

The simplest pattern:

1. Create a dedicated break-glass account (e.g. breakglass@yourcompany.example) with Organization Owner and Mandatory Email MFA enabled.
2. Don’t enrol that account in your IdP, so SAML never claims it.
3. Lock its password in your password manager and document the recovery email account.

A second Organization Owner who uses SAML day-to-day is fine — the requirement is just that at least one Owner can always sign in without your IdP’s cooperation.