Signing in with Microsoft SSO

If your organisation uses Microsoft Entra ID, your team can sign in to Lano with their existing Microsoft work accounts instead of a separate Lano password. This article explains how to add users when SSO is enabled, how to log in, and what to do if someone can't sign in.

Single Sign-On handles authentication only - it confirms who a user is. It does not create Lano accounts and does not assign roles or permissions. This means every user still has to be invited to Lano first. SSO only changes how they log in.

An Admin on your Lano account can invite new users:

1. Go to Settings → Users

2. Click Invite User

3. Fill in the required fields:

   • Name & email

   • Role (Admin, Manager, Finance, or Expense Approver)

   • Entities the user should have access to

   • If assigning the Expense Approver role: select the employees whose expenses this user should be able to review

4. Click Send Invite
   

   Important: the email address must exactly match the one that the person uses in your Microsoft Entra ID directory. If the addresses don't match, their sign-in will be rejected.

Lano uses email-first login. The user enters their email address, and Lano recognises that their organisation uses SSO.

1. The user opens the Lano login page and enters their email address

2. They are redirected straight to Microsoft - no password field appears on Lano's side

3. They sign in with Microsoft, following whatever your organisation requires (password, MFA, conditional access)

4. Microsoft returns them to Lano and they are signed in
   

   Users who belong to an organisation without SSO see the normal password field instead.

The very first time anyone from your organisation signs in, Microsoft will ask one of your IT administrators to approve access on behalf of the whole organisation.

Once that approval is given:

• Every other user in your organisation can sign in without any further prompts

• No certificates or keys need to be exchanged with Lano

Lano only requests the openid, profile and email scopes - enough to confirm identity. Lano does not request access to your directory, groups, mailboxes or files.

Roles are managed entirely in Lano. Group membership in Microsoft Entra ID does not map to Lano roles.

To change a role or entity access:

1. Go to Settings → Users

2. Select the user

3. Click Edit

To revoke someone's access:

• Click Delete next to their name in Settings → Users

• Their access is revoked immediately

• You can re-invite them later if needed

Note: Removing a person from your Microsoft Entra ID directory does not remove them from your Lano user list. Both steps are needed when someone leaves.

If a user can't sign in, they'll see a generic error message. For security reasons, the message doesn't say why. The most common causes are:

If none of these apply, contact your Lano representative.

SSO is enabled per organisation and set up by Lano during onboarding. To turn it on, contact your Lano representative - they'll need your Microsoft Entra Tenant ID, which your IT team can provide.

• Managing Users in Lano

• Joining an Existing Company Account in Lano

• User Roles Explained