Microsoft 365 Single Sign-On

What is it?

Enable Single Sign-On with Microsoft 365 (Office 365, Azure Active Directory) and users can sign in to eHour with their Microsoft 365 account. Users do not have to remember a separate eHour password, they authenticate through your directory.

Single Sign-On first must be enabled in eHour by an admin before users can sign in with their Microsoft account.

Microsoft Accounts and eHour users are matched on their email addresses. Users in eHour and Microsoft should have the same email address (UPN) to be able to log in.

The benefits of SSO
Convenience. Users no longer have to struggle with multiple passwords and remembering which one is for which account.
Productivity. When eHour is easier to access, it will be used more effectively.
Reducing Risk. Having only one access point minimizes the likelihood of users using simple easy-to-crack passwords. Plus you can have one company-wide password policy enforced in Microsoft 365.

How to enable SSO with Microsoft?

To enable Single Sign-On (SSO) with Microsoft, a Microsoft Admin user must first give a one-time consent to allow eHour to authenticate. After consent is given, the "eHour Time Tracking" app will be registered in your Azure Active Directory.

1. As an eHour Admin, click on the gear icon and select Single Sign-On (SSO)
2. Select Microsoft as the Identity Provider.
3. Click "Enable Microsoft 365
4. In the Microsoft login screen, sign in with your Microsoft Admin account.
5. Review the permissions the eHour Time Tracking app requires and click on Accept.
6. You are redirected back to eHour, Single Sign-On is now enabled.

How can I sign in with my Microsoft account?

When Single Sign-On is enabled you can use the "Sign with Microsoft" button on the eHour login page to sign in with your Microsoft account. Bookmark https://ehourapp.com/oauth2/authorization/azure to bypass the login page.

Disable eHour password login

As an extra security measure, you can configure eHour to allow users to sign in only using their Microsoft account. When enabled, users can no longer sign in to eHour with their eHour password.

To prevent any account lockouts; eHour admins are always allowed to sign in with their eHour password, regardless of whether this is disabled for other users.

To only allow Microsoft accounts:

1. As an Admin, click on the gear icon and select Single Sign-On
2. When Single Sign-On is enabled, enable the "Only allow access with a Microsoft account" switch and press save.