This is the reference for how Microsoft 365 sign-in (also known as single sign-on, SSO or Microsoft Entra) behaves. To set it up, see Set up Microsoft 365 sign-in for your company. For the steps users follow, see Sign in with Microsoft 365.

What has to be in place

All of these, or a user can't sign in with Microsoft:

Layer support has enabled it for the company.
At least one tenant is saved on the settings page. With none saved, sign-in is refused.
The user's Microsoft account belongs to a saved tenant.
The user's Layer account is active and linked to that Microsoft account.
No other active user in the company has the same email address.

These are checked at every sign-in, not only when linking. The button shows on the login page for everyone, because The Layer doesn't know which company you're from until you've signed in.

Tenants

Up to 20 per company, entered as tenant IDs. Domain names aren't accepted.
Work and school accounts only. Personal Microsoft accounts (outlook.com, hotmail.com) can't be used.
An account from another organisation, such as a contractor's, signs in through its own home tenant, so that tenant has to be on your list.
Once a user links, they're tied to the tenant they linked from.
Changes apply from the next sign-in.

Linking

Each user links once, using their Layer username and password. Their email address isn't accepted on that page.
If the company uses Layer two-factor authentication and the device isn't trusted, a code is needed before the link is made.
The Layer never links automatically by email address. The Microsoft email doesn't have to match the Layer email, and the link keeps working if either one changes.
A Microsoft account can link to one Layer user, and a Layer user to one Microsoft account. Someone with two Layer accounts needs a separate Microsoft account for each, or can use Microsoft sign-in on only one of them.
A link can only be replaced after an administrator removes it. Users can't remove their own.
The user is emailed each time a link is made.

Microsoft 365 only

It's set per company by a CRM Administrator.
It isn't enforced until sign-in is enabled and a tenant is saved, so turning it on too early can't lock anyone out.
It only applies to linked users. Unlinked users keep their passwords, and nothing forces them to link.
For linked users, the password is refused on the login page and for new API tokens.
Removing a user's link gives them their password back.
A linked user whose tenant is removed from the list can't sign in by either route until their link is removed.
If someone has accounts in more than one company, each company's setting applies to its own account.

Two-factor and Microsoft MFA

The Layer doesn't ask for its own two-factor code after a Microsoft sign-in, apart from when linking.
MFA and Conditional Access are set in your Microsoft tenant. The Layer doesn't check that they're on. If your tenant doesn't require MFA, Microsoft sign-in to The Layer has no second factor.
Layer two-factor still applies to password sign-in.

Sessions and signing out

A Layer session ends after 8 hours with no activity, however you signed in.
Logging out of The Layer doesn't sign you out of Microsoft, and signing out of Microsoft doesn't log you out of The Layer.
Microsoft shows its account picker at every sign-in.
Layer password expiry still applies. If it's enforced for a user and their password has expired, they're asked to change it after signing in with Microsoft.

Apps and the API

Where	Microsoft sign-in?
The Layer in a browser	Yes.
The Layer for Outlook	No. It uses your Layer username and password, so linked users can't sign in to it while Microsoft 365 only is on.
API logins with a username and password	No. New tokens are refused for linked users while Microsoft 365 only is on. Tokens already issued keep working until they expire or are revoked.
Customer Portal	No. Portal users sign in with their portal details.

What it doesn't do

Automatic sign-in. Users always start at the login page and click the button.
Creating users. Each person needs an existing Layer user. Accounts aren't created when someone first signs in.
Syncing from Microsoft. There's no SCIM or group sync. Users, roles and deactivations are managed in The Layer.
Single sign-out. Signing out of one doesn't sign you out of the other.
Other identity providers. Only Microsoft is supported.

What The Layer stores

For each link, The Layer stores the user's Microsoft account ID, tenant ID and email address, plus when the link was made and last used. It asks Microsoft only for the user's identity, name and email address. It never sees the user's Microsoft password.

Limits on failed attempts

After 5 failed attempts for a username, or 50 from one IP address, within 15 minutes, further attempts are refused until the count drops. A user cancelling at Microsoft, or being sent to the link page for the first time, doesn't count.

Shared email addresses

Two or more active users in the same company with the same address (ignoring capitals and spaces) are blocked from Microsoft sign-in and from linking.
Password sign-in isn't affected by this rule.
CRM Administrators are emailed when someone is refused, at most once an hour for each address. The users are also listed on the settings page, and each user's page shows a warning.
Nothing needs resetting. As soon as each user has their own address, they can sign in.

Error messages

Message	Why	Fix
Microsoft 365 sign-in is not enabled for your company.	Layer support hasn't enabled it.	Contact Layer support.
Microsoft 365 sign-in has not been set up for your company yet.	No tenant is saved.	Save a tenant on the settings page.
Your Microsoft 365 organization is not configured for this Layer account.	The user's tenant isn't on the list.	Add the tenant, or have them choose the right Microsoft account.
Your Layer account shares an email address with another user in your organisation.	Another active user has the same address.	Give each user their own address.
Your Layer account is already linked to a different Microsoft 365 account.	The Layer user has a link to another Microsoft account.	Remove the link from the user's page, then link again.
This Microsoft account is already linked to another Layer user.	The Microsoft account is in use on another Layer user.	Remove the link from that user. If you can't find it, contact Layer support.
Invalid username or password.	The Layer details on the link page are wrong.	Use the Layer username, not the email address. Reset the password if needed.
Your account is not active.	The Layer user is deactivated.	Reactivate the user if they should have access.
Too many failed attempts.	The limit above was reached.	Wait up to 15 minutes. Check Sign-in activity if it's unexpected.
Your session has expired.	The link page was left open too long.	Start again from the login page.
Access was denied.	The user cancelled, or Microsoft refused access.	Try again, or check whether the app is restricted to assigned users in Microsoft.
Administrator consent is required.	Your Microsoft settings don't let users approve apps.	Your Microsoft 365 administrator needs to approve it.
Additional verification is required.	Microsoft wants another step it couldn't complete.	Try again, and check your Conditional Access policies.

Sent to Link Your Account when already linked: The Layer didn't accept the link at this sign-in. Usually the user chose a different Microsoft account, their tenant was removed from the list, or sign-in was turned off for the company. Check Settings > Users > Sign-in activity for the reason.

Microsoft 365 sign-in: rules, limits and error messages