This guide is for Layer administrators. It covers switching on Microsoft 365 sign-in (also known as single sign-on, SSO or Microsoft Entra), rolling it out to your users, and looking after it afterwards.

You'll need the CRM Administrator role in The Layer, and someone who can get to your company's Microsoft Entra admin centre.

Before you start

Every user needs their own email address in The Layer. If two active users share an address, Microsoft 365 sign-in is blocked for both until it's fixed.
Every user needs to know their Layer username and password. They use them once, to link their account. The Layer doesn't match people by email and doesn't create accounts automatically.
Check who uses The Layer for Outlook or anything else that signs in with a Layer password. This matters if you plan to turn on Microsoft 365 only (see step 6).

Set it up

1. Ask Layer support to enable it

Contact Layer support and ask for Microsoft 365 sign-in to be enabled for your company. You can't turn this part on yourself.

2. Find your tenant ID

In the Microsoft Entra admin centre, open Overview and copy the Tenant ID. It looks like 12345678-1234-1234-1234-123456789abc. Your domain name won't work here.

3. Save the tenant in The Layer

Go to Settings > Microsoft 365 sign-in. If you can't see the tile, add /settings/microsoftsignin to your Layer address.
Under Allowed Microsoft 365 tenants, paste your tenant ID.
Click Save.

Sign-in works as soon as you save. Until a tenant is saved, nobody in your company can use it.

4. Test it with your own account

Log out, click Sign in with Microsoft 365 and follow the steps. Then check you can see the link on your user page.

If Microsoft asks for an administrator's approval, your Microsoft settings don't let users approve apps themselves. Your Microsoft 365 administrator will need to approve it. Sign-in asks Microsoft only for the user's identity, name and email address.

5. Tell your users

Send them Sign in with Microsoft 365. Each person links their own account the first time they use it. Nothing changes for anyone until they do, and their password keeps working.

6. Optional: turn on Microsoft 365 only

Once your users have linked, you can stop them using their Layer passwords.

Go to Settings > Microsoft 365 sign-in.
Under Sign-in policy, tick Require Microsoft 365 sign-in for users who have linked their Microsoft account.
Click Save.

Before you turn it on

It only applies to users who have linked. Anyone who hasn't linked keeps their password, for as long as they don't link. There's no way to force linking or set a deadline.

For linked users, the Layer password also stops working for The Layer for Outlook, API logins and anything else that signs in with a username and password. New sign-ins to those are refused, so check who relies on them first.

The settings page

Settings > Microsoft 365 sign-in is only open to CRM Administrators.

Setting	What it means
Available on this platform	Should say Yes. If it says No, contact Layer support.
Enabled for your company	Whether Layer support has enabled it (step 1).
Microsoft 365 sign-in only	Whether linked users are actually being held to Microsoft sign-in. It can be switched on but not enforced, until a tenant is saved.
Storage	This only appears if something is missing on our side, and Save will be disabled. Contact Layer support.
Microsoft 365 only	The tick box from step 6. It's greyed out until Layer support has enabled sign-in for your company.
Users sharing an email address	Only appears when there's a problem. Lists the users who are blocked, with links to fix them.
Tenant IDs	The Microsoft tenants your users can sign in from. Up to 20, one per line. Leave it empty to turn sign-in off for your company.

Changes are recorded in your company's audit trail.

Managing users

See whether a user has linked

Go to Settings > Users, edit the user and open the System tab. The Microsoft 365 Single Sign-On section shows whether they're linked, the Microsoft email address, the date it was linked and when it was last used. It only appears if sign-in is enabled for your company.

Remove a link

Click Remove Microsoft 365 Link in the same section. You'll need to be a CRM Administrator or have permission to edit users. The user can then sign in with their Layer password, and links again the next time they use Microsoft.

You'd remove a link when:

Someone linked the wrong Microsoft account, or doesn't recognise a link.
A user's Microsoft account has been replaced, for example deleted and recreated or moved to a new tenant. The new one counts as a different account.

Removing a link doesn't sign the user out of a session they already have open.

When someone leaves

Disabling someone in Microsoft doesn't remove their access to The Layer on its own. It stops new Microsoft sign-ins, but:

A session they already have open carries on until it's been idle for 8 hours.
Their Layer user stays active, and their password still works unless Microsoft 365 only applies to them.
API tokens they already have keep working until they expire or are revoked.

So always deactivate the user in The Layer as well as in Microsoft.

Changing tenants

Removing a tenant takes effect at the next sign-in for everyone in it.

Be careful with Microsoft 365 only

If Microsoft 365 only is on and you remove a tenant that linked users belong to, those users can't sign in at all: Microsoft sign-in is refused and their password is blocked. Remove their links first so they can use their passwords.

Check sign-in activity

Settings > Users > Sign-in activity lists sign-in attempts for your company, and is where to look when someone can't get in. Look for these in the Result column:

Result	What happened
Authenticated via Microsoft 365	Signed in successfully.
Account linked successfully	The user linked their Microsoft account.
Login Failed - tenant not allowed	Their tenant isn't on your list.
Login Failed - tenant mismatch	They signed in from a different tenant from the one they linked with.
Login Failed - duplicate email	Another active user has the same email address.
Password login blocked - SSO-only mode enforced	A linked user tried their password while Microsoft 365 only is on.
Token auth blocked - Microsoft 365 only	A linked user's password was refused by the API, for example from The Layer for Outlook.

More detail

For every rule and limit, and what each error message means, see Microsoft 365 sign-in: rules, limits and error messages.

Set up Microsoft 365 sign-in for your company