Single Sign-On (SSO) lets users log in to Pace Scheduler with the same credentials they use for your organization’s network. Instead of remembering separate usernames and passwords, employees are authenticated using their User Principal Name (UPN) from Microsoft Entra ID (formerly Active Directory). This improves security, simplifies login, and ensures account access is centrally managed by your IT department.

Before you begin

• You must be an Admin in Pace Scheduler.

• You must coordinate with your IT department to confirm UPNs are configured for SSO in your Microsoft Entra environment.

• SSO must be enabled by Pace Support.

Understanding SSO and UPN

• Single Sign-On (SSO): A method that allows users to sign in once with their organization’s credentials and automatically gain access to multiple applications, including Pace Scheduler.

• User Principal Name (UPN): The unique identifier used for authentication in Microsoft Entra ID. A UPN looks like an email address, for example:

  • [email protected]

  • [email protected]
    The UPN must match what Pace Scheduler receives during login. If UPNs are not properly configured, users will not be able to authenticate with SSO.

Steps

1. Confirm UPNs in your Entra environment

   • Work with your IT department to verify that each employee’s UPN is set correctly and enabled for SSO.

2. Provide Pace Support with your login domain(s)

   • Gather the domain names (e.g., @hometownpd.gov, @cityfire.org) used in your UPNs.

   • Send these to Pace Support for SSO configuration.

3. Pace Support enables SSO

   • Pace Support will enable SSO for the provided domains.

   • Warning: Once enabled, username/password login is disabled for these accounts. Users will be locked out until the first SSO login succeeds.

4. Test with IT

   • Have an IT representative attempt the first login.

   • If login is successful, SSO is active for your domain.

   • If login fails, it means the UPNs are not properly configured in Entra ID. IT will need to correct the UPNs before retrying.

Confirm it worked

• Users can log in using their organizational account without entering a Pace Scheduler password.

• Password fields will no longer be available on the login page.

• Admins should confirm that multiple users from the same domain can log in successfully.

Troubleshooting

• Error: “We couldn’t find an account with that email address.”

  • The UPN does not match the domain registered with Pace Scheduler. Verify domain spelling and format.

• Error: “Login failed.”

  • The UPN is not enabled for SSO in Entra ID. IT must update the UPN.

• User is still prompted for a password.

  • SSO is not yet enabled for the domain. Contact Pace Support.

• Only some users can log in.

  • Check that all users have the correct UPN suffix (e.g., @cityfire.org). Mismatched or alternate domains need to be added.

FAQ

Q: Can we keep both SSO and password login active?
A: No. Once SSO is enabled for a domain, password login is disabled to maintain security.

Q: Can we enable SSO for only some users?
A: No. SSO is applied at the domain level. All users with that UPN domain will authenticate via SSO.

Q: Can multiple domains be supported?
A: Yes. Provide all required domains (e.g., @police.gov and @city.gov) to Pace Support.

Q: What if our UPNs don’t match user email addresses?
A: The UPN, not the email, must be used for login. IT may need to align these fields or communicate the correct UPN format to staff.

Q: What if we change our domain name later?
A: You’ll need to notify Pace Support and have the new domain added for SSO.