Configure identity, MFA, and user lifecycle
Verify sign-in configuration and session security with tenant-scoped test accounts.
Demo baseline · November 13, 2026Configure identity
Open Find a workspace → Administration and select Identity providers, Federation & provisioning, or User directory integrations for the task. Verify the tenant and keep an approved recovery account available while changing federation. Use the tenant-provided callback or ACS information and the identity provider's approved credentials.
- Confirm the provider protocol, issuer/entity ID, callback/ACS URL, audience and claim mapping. Use protected credential storage.
- Test with a scoped identity and check that the expected tenant, group and role are applied. Confirm MFA enforcement and any required fresh verification on sensitive operations.
- For provisioning, preview or test a limited user/group scope and verify external identity matching. Check deactivation and reactivation behavior before broad rollout.
- Record the working configuration and access checks. If sign-in fails after activation, restore the prior reviewed configuration through the approved recovery account and validate sign-in again.
Investigate sessions and recovery
Use Account security to inspect your sessions. Administrative session review and revocation require authorized access and fresh verification where shown. For supervised recovery, verify identity through the configured process, record the reason and required approval, then confirm reenrollment and audit evidence. See Sign in and recover access.