--- title: "Set up Microsoft Entra ID Single Sign-On (SSO) for Enterprise Hub and link user accounts" slug: "set-up-microsoft-entra-id-single-sign-on-sso-enterprise-hub-link-user-accounts" tags: ["Area - Settings", "Focus - Construction", "Focus - Service Replacement", "Role - Admin", "Type - Commercial", "Type - Residential"] updated: 2026-10-15T00:32:27Z published: 2026-10-15T00:32:27Z canonical: "help.servicetitan.com/set-up-microsoft-entra-id-single-sign-on-sso-enterprise-hub-link-user-accounts" excludeFromExternalSearch: true --- > ## Documentation Index > Fetch the complete documentation index at: https://help.servicetitan.com/llms.txt > Use this file to discover all available pages before exploring further. # Set up Microsoft Entra ID Single Sign-On (SSO) for Enterprise Hub and link user accounts ## Overview Securely connect Microsoft Entra ID (Azure AD) to Enterprise Hub (EH) to enable Single Sign-On (SSO). This one-time setup enhances security, reduces IT support costs, and streamlines user access with seamless Entra-based authentication. --- ### #### Who uses this feature - Administrators - Applies to all business types - Applies to all trades #### Feature configuration - This feature is currently in Private Preview. It is subject to change. If you're interested in joining the waitlist for the Private Preview, please fill out [this form](https://docs.google.com/forms/d/e/1FAIpQLSdJd1mox5wjf2Yl2zBuCbbmM6aQwcPbbvqsId2RcGW5gE1B4Q/viewform). ## Before you get started The setup consists of two parts: 1. [Administrator configuration (one-time setup)](/construction/docs/set-up-microsoft-entra-id-single-sign-on-sso-enterprise-hub-link-user-accounts#administrator-setup-connect-microsoft-entra-id-to-enterprise-hub): Connect Microsoft Entra ID to Enterprise Hub. 2. [User account linking (one-time per user):](/construction/docs/set-up-microsoft-entra-id-single-sign-on-sso-enterprise-hub-link-user-accounts#user-experience-credentialbased-account-linking) Securely link a user's Entra identity to their Enterprise Hub account. When completed: - Users sign in using Sign in with Microsoft Entra ID. - No separate Enterprise Hub password is required for future logins. - Authentication is securely managed through your company's Entra tenant. ## Administrator setup: connect Microsoft Entra ID to Enterprise Hub - The user performing this setup must have: - The *Manage SSO* permission enabled under the *Settings* section in Enterprise Hub. - Microsoft Entra administrator permissions. > [!NOTE] > **Note:** If you're not a Microsoft Entra administrator, forward the link to a user who has Microsoft Entra administrator permissions. - You must have Microsoft Entra administrator permissions. Be sure to have your Microsoft Entra Tenant ID available. The Tenant ID does not need to match your organization's registered ServiceTitan environment. - The connection remains in a *Pending* state until activated. - To access different environments for example, Go or Next, each environment must be configured separately for Microsoft Entra SSO. ## Connect your Entra Tenant ID to Enterprise Hub ### Step 1: Get Your Entra Tenant ID 1. Sign in to the **Microsoft Entra Admin Center** with administrator rights. 2. Locate and copy your **Tenant ID**. ![Overview of Microsoft Entra admin center showing Tenant ID and authentication policy alert.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-g9u4vk8a.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) This value is required during Enterprise Hub setup. ### Step 2: Enable the Manage SSO Permission Before beginning setup, confirm that your Enterprise Hub administrator has the correct permission. 1. In **Enterprise Hub**, go to **Settings > Single Sign-On (SSO).** 2. Ensure your user profile includes the *Manage SSO* permission under the *Settings* section. 3. If no SSO connections exist, the page will appear empty. 4. Click **Add Connection**. ![ServiceTitan interface showing Single Sign-On settings with an 'Add Connection' button highlighted.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-tgm9bbo3.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) If the SSO page is not visible, verify that the *Manage SSO* permission is enabled. ### Step 3: Create a new SSO integration A setup drawer opens prompting you to: 1. Enter a **Name** for your integration. 2. Paste the **Entra Tenant ID** from Microsoft Entra Admin Center. ![Instructions for connecting Microsoft Entra ID with required fields and options.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-qk2kppws.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) 3. Click **Proceed with Entra ID set up**. A pop-up notification confirms that a new activation URL has been copied to your clipboard. ### Step 4: Activate the connection 1. Paste the copied URL into a new browser window or forward the URL to your Microsoft Entra Administrator. 2. Review and accept the *Microsoft Permissions* screen. 3. Sign in with your Entra administrator credentials. ![Microsoft login page requesting permissions for ServiceTitan application access.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-2i9ajrf7.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) After successful authentication: - Enterprise Hub automatically verifies the connection. - The SSO integration status changes from *Pending* to *Active*. - The connection is now complete. ![Success message indicating Entra identity provider configuration is complete.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-4gtbdk82.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) ## User experience: credential-based account linking When SSO is activated and the auto-linking button is enabled, users can begin signing in with Microsoft Entra ID. The first time a user signs in by Microsoft Entra, they must complete a one-time account verification process. > [!NOTE] > **Note:** Administrators should remember that: - This account linking flow applies only to users logging in by Microsoft Entra ID for the first time. - Users must belong to the same Microsoft Entra organization that was configured for SSO to complete auto-linking. ## Link your user account to Enterprise Hub ### Step 1: User signs in with Microsoft Entra ID 1. Go to the Enterprise Hub login screen. 2. Click **Sign in with Microsoft Entra ID**. ![Login screen for Enterprise Hub with Microsoft Entra ID sign-in option.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-dmgcyrpy.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) The user is redirected to Microsoft to authenticate with their organization's credentials. > [!NOTE] > **Note:** If you have more than one account, you will be prompted to select an account. ![Microsoft account selection screen showing signed-in account and option to add another account.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-vpa6jt2n.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) ### Step 2: Redirect back to Enterprise Hub After successful Entra authentication: - The user is redirected back to Enterprise Hub. - The system detects that their Entra ID has not yet been linked to an Enterprise Hub account. ### Step 3: One-Time Enterprise Hub credential prompt The user sees the message: "To securely link your accounts, please sign in one time with your Enterprise Hub password." This ensures the Entra identity belongs to the correct Enterprise Hub account holder. ![Instructions for linking ServiceTitan account with Microsoft Entra ID for secure access.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-l3ll00sj.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) ### Step 4: Account linking verification 1. The user enters their Enterprise Hub username and password. 2. If authentication is successful: 1. Enterprise Hub creates a permanent, verified link between: 1. The user's Entra identity (object ID + tenant ID) 2. Their internal Enterprise Hub account This step occurs only once. ![Login screen for Enterprise Hub with username input and continue button.](https://cdn.document360.io/961862ab-d0f2-4d91-bb62-a62ee8184eff/Images/Documentation/set-up-microsoft-entra-id-single-sign-on-sso-and-link-user-accounts-image-pbxsh0dy.png?sv=2026-02-06&spr=https&st=2026-10-31T02%3A40%3A31Z&se=2026-10-31T03%3A40%3A31Z&sr=c&sp=r&sig=D%2B9tNbWURZ5Sn0VboIJdjxXFkVGUa8F68Wmk5EpaAus%3D) ### Step 5: Seamless future logins After the account is linked: - Users click **Sign in with Microsoft Entra ID.** - They are automatically signed in. - The Enterprise Hub password prompt does not appear again. All future logins are SSO-only experiences. ## Security safeguards Enterprise Hub SSO implementation includes multiple layers of protection. **Inter-tenant account takeover (ATO) prevention** - Each login token from Microsoft Entra includes a tenant ID (tid). - Enterprise Hub verifies that this matches the pre-configured Entra Tenant ID. - Cross-organization login attempts are blocked. - This prevents users of unauthorized Entra tenants from accessing your Enterprise Hub environment. **Explicit user verification** - The one-time Enterprise Hub credential prompt confirms the user is a validated Enterprise Hub account holder. - This prevents unauthorized Entra users from linking to the wrong Enterprise Hub identity. **Secure token validation** - After linking, the Entra ID connection is securely stored. - On every login, Enterprise Hub validates: - Entra authentication tokens - Tenant configuration - Administrators can revoke or re-establish links if needed. ## Want to learn more? - See [Manage Single Sign-On (SSO) in Enterprise Hub](https://fieldroutes-new.document360.io/shared/e5470022-d0bb-4f41-9563-4ffb509f64b1)