FAQ About Azure AD SSO

Most SSO projects don't fail on the identity provider side — they fail on the vendor side. Azure AD (now Microsoft Entra ID) has supported SAML 2.0 and OpenID Connect for years, and configuring an enterprise application in the Azure portal takes minutes. The real friction shows up when a SaaS vendor charges a premium for SSO, ships a half-implemented SAML endpoint, or can't answer basic questions about attribute mapping. This FAQ addresses the questions IT directors, compliance officers and procurement teams actually ask when SSO becomes a line item in a contract — including how it applies when you're buying retail analytics platforms such as people counting dashboards.

Is Azure AD SSO the same thing as Microsoft Entra ID SSO?

Functionally, yes. Microsoft rebranded Azure Active Directory to Microsoft Entra ID in 2023. The protocols, the enterprise application gallery, conditional access and the admin experience carried over. Vendors, documentation and RFP templates still say "Azure AD SSO" interchangeably, and you'll see both terms for years. If a vendor's security questionnaire only references the old name, that alone isn't a red flag — but ask when their integration documentation was last reviewed. Stale docs often correlate with stale implementations.

SAML or OpenID Connect — which should we require from vendors?

Both work with Entra ID, and for a browser-based dashboard the end-user experience is identical. The practical differences matter to your security team:

• SAML 2.0 is the enterprise default. Mature, widely supported, but certificate rotation is a manual chore — Entra ID signing certificates expire every three years by default, and an expired certificate is the single most common cause of a sudden company-wide lockout from a SaaS app.
• OpenID Connect (OIDC) handles token lifetimes and key rollover automatically via published metadata. If a vendor offers both, prefer OIDC for lower operational overhead.
• SCIM provisioning is the third piece most teams forget. SSO controls who can log in; SCIM controls who has an account. Without automated deprovisioning, a terminated employee's session may persist until token expiry — a finding auditors flag routinely.

What does SSO actually cost, and why do vendors charge for it?

On the Microsoft side, SSO for gallery and custom SAML/OIDC applications is included in Entra ID Free and P1 tiers, though conditional access requires P1 and risk-based policies require P2. The vendor side is where procurement teams get surprised: the "SSO tax" — gating single sign-on behind an enterprise tier — remains common across SaaS. During procurement, treat SSO support as a security requirement, not a convenience feature, and negotiate it into the base contract. A vendor that charges triple for the privilege of not managing another password database has priced its own security posture into your risk register.

How does conditional access change the picture?

Conditional access is the reason to centralise on Entra ID in the first place. Once an application authenticates through your tenant, you can require MFA, block legacy authentication, restrict access by device compliance state or network location, and apply session controls — all without the vendor building any of it. For a retail organisation, this means the analytics dashboard your regional managers check from store tablets can carry the same access policy as your ERP. One caveat implementers learn the hard way: conditional access evaluates at token issuance, not continuously. Pair it with short token lifetimes or continuous access evaluation for applications handling sensitive data.

What should compliance officers verify before approving an SSO integration?

SSO reduces credential sprawl, but it doesn't answer the data protection questions on its own. Before sign-off, confirm three things with any vendor:

• What attributes leave your tenant. A SAML assertion typically carries email, name and group claims. Strip anything the application doesn't strictly need — least privilege applies to claims, not just roles.
• What the application stores. SSO governs access to data; it says nothing about what data exists behind the login. This distinction matters most with analytics platforms. Vemco Group, for example, designed its people counting around GDPR compliance from the data layer up: no personal identification, staff traffic excluded, and only aggregate visitor counts stored — so the dashboard behind your SSO gateway contains no personal data to protect in the first place.
• Where the data lives. Hosting model matters for residency obligations. Vemco offers both hosted and private cloud deployment and integrates with existing IT systems, which gives compliance teams options rather than a take-it-or-leave-it architecture. Whatever vendor you assess, verify certifications, data-residency commitments and retention periods in writing — never accept them verbally in a sales call.

A practitioner's note: test the break-glass path before you need it

Every experienced implementer has a story about enforcing SSO on a Friday and discovering the vendor's "disable local login" toggle also disabled the admin account that manages the SAML configuration. Before cutting over any application, confirm two things: that at least one emergency local admin account survives the SSO enforcement, and that you know the vendor's support process for resetting a broken SAML config. Test the failure mode deliberately in a staging tenant. It takes twenty minutes and has saved more weekends than any monitoring tool.

Does SSO matter for retail analytics specifically?

More than most categories, because access is broad and shallow. A people counting platform is typically used by dozens or hundreds of store managers, regional directors and merchandising analysts — each needing read access to their own locations, and staff turnover in retail is high. Manual account management at that scale guarantees orphaned accounts. Centralised identity with group-based access assignment solves it. The data itself also justifies protection: when counting accuracy sits at a contractual minimum of 96% — and typically reaches 98–99% where lighting, layout and visitor behaviour allow — traffic data becomes reliable enough to drive staffing and conversion decisions, which makes it commercially sensitive even when it contains nothing personal. A platform trusted by 2000+ customers across 95+ countries, as Vemco has been since 2005, will have encountered nearly every enterprise identity setup; ask any vendor you evaluate for reference architectures matching yours.

Where should we start?

Inventory your SaaS estate, rank applications by data sensitivity and user count, and enforce SSO plus conditional access on the top tier first. Fold SSO, SCIM and residency requirements into your procurement templates so every new contract inherits them. And when evaluating analytics vendors, weigh both halves of the equation: how you authenticate, and what's actually stored behind the login.

Evaluating people counting for an enterprise environment with strict identity and compliance requirements? Talk to Vemco Group about deployment options, IT integration and GDPR-compliant data handling — contact us here and bring your security questionnaire.