Single Sign-on and Multi-factor Authentication

MarTech3D | Engine supports company login and multi-factor authentication through a customer's own identity provider.

This allows users to access MarTech3D | Engine using their existing company login, for example through Microsoft Entra ID, Okta, Google Workspace or another recognised provider.

Multi-factor authentication is normally enforced by the customer's own identity provider, so existing company security policies can apply when users access MarTech3D | Engine.

✅ What is included as standard

Standard company login setup is included where the customer uses a recognised identity provider and a standard authentication method.

Included as standard	Details
One customer identity provider	For example Microsoft Entra ID, Okta or Google Workspace
One standard connection	A single connection between MarTech3D \| Engine and your identity provider
Standard authentication setup	For example OpenID Connect or Security Assertion Markup Language
Customer-managed multi-factor authentication	Multi-factor authentication remains managed by your identity provider
Manually created MarTech3D users	Users are created in MarTech3D \| Engine and matched by email address
Standard setup and testing	Configuration and validation with your technical team

🔐 How standard setup works

For standard setup, user accounts are created in MarTech3D | Engine first using each user's company email address.

When a user logs in through your identity provider, MarTech3D | Engine checks the authenticated email address and matches it to the existing user account.

If someone from your organisation signs in successfully but has no MarTech3D | Engine account yet, they are not turned away. Their request is placed in an approval queue and they are told an administrator will review it. Nobody gains access until that request is approved and an account is created.

This keeps the setup simple, secure and easy to manage.

➕ What may require an additional licence add-on

Some requirements go beyond standard company login setup and may require an additional enterprise licence add-on.

Additional requirement	Example
Multiple identity providers	Different login systems for different regions, brands or business units
Multiple connections	Separate connections for different environments or user groups
Automated user creation and removal	Users automatically added or removed in step with your directory
Group-based access rules	User permissions controlled automatically by company groups
Advanced role mapping	Different access levels derived from your directory groups
Bespoke security workflows	Custom approval, login or access requirements
Non-standard technical requirements	Anything outside a standard identity provider setup

🔧 How to set it up

Setup runs in five short steps. Steps 2 and 3 are yours, step 4 is ours, and step 5 is joint.

Step 1. Confirm scope

Tell your account manager which identity provider you use and which authentication method you prefer. We confirm what is included as standard and send you two web addresses you will need next: a redirect URI and your sign-in URL.

Step 2. Register MarTech3D | Engine in your identity provider

The steps below are for Microsoft Entra ID. Steps for other identity providers follow the same shape and are confirmed with your technical team during scoping.

In Entra admin centre → App registrations:

New registration. Name it MarTech3D | Engine . Supported account types: Accounts in this organizational directory only (single tenant).
Redirect URI. Platform: Web. Add both addresses we sent you, one for the verification test and one for live service. Adding both now avoids a second change request between testing and go-live. Enter them exactly as supplied: Entra performs an exact string match, so a trailing slash or a change of case will cause every sign-in to fail.
API permissions. Microsoft Graph → Delegated → openid , profile , email . Then grant admin consent for the tenant. No application permissions and no write scopes are required. We do not read your directory.
Certificates & secrets. Create a client secret. Record the value and the expiry date. The value is shown only once.
Token configuration. Add email , given_name and family_name as optional ID claims. This step is worth double checking: accounts without a mailbox in your tenant, typically .onmicrosoft.com addresses, are not issued an email claim unless it is added here, and sign-in then fails for those users.
Conditional Access. If your policies apply to named applications, add the new registration to the relevant policies. A missing policy assignment is the most common cause of an "access blocked" message at go-live.

Step 3. Send us the details

Complete the short form in the next section and return it to your account manager. Send the client secret value through a secure channel, such as a one-time secret link or a password-protected archive, rather than in plain email.

Step 4. We configure your connection

We create your connection, load your users, and confirm the stored values back to you. Nothing changes for your users at this stage.

Step 5. Verify, then go live

Two of your nominated users sign in end to end, including a real multi-factor prompt. Once you confirm both worked, we switch your organisation to company login on an agreed date and change window. Your users then reach MarTech3D | Engine using the sign-in URL we provided, or by choosing Use single sign-on on the standard login screen.

📝 Information required for setup

#	What we need	Notes
1	Identity provider and authentication method	For example Microsoft Entra ID with OpenID Connect
2	Technical contact: name, email, phone	Someone able to make application registrations in your tenant
3	Tenant ID	The directory GUID
4	Application (client) ID	From the registration created in step 2
5	Client secret value and expiry date	Send via a secure channel. We contact you before it expires
6	Email domain your users sign in with	For example `contoso.com` . List all of them if more than one
7	Which claim carries the user's routable email address	Usually `email` . Tell us if your usernames differ from your email addresses, as this is the value we match on
8	Confirmation that multi-factor authentication is enforced, and any Conditional Access policies that will apply	We do not configure MFA, we inherit it
9	The users who need access: email address, first name, last name, access level	Access level is Company Administrator or Company Sales Agent
10	One administrator to keep password sign-in as a break-glass account	Strongly recommended. Without it, an outage of your identity provider leaves no route into your own administration
11	Any specific technical or security guidelines we need to follow	Change windows, approval processes, security review requirements

ℹ️ Important note

Standard company login and multi-factor authentication setup is included for recognised identity providers using standard setup.

Advanced requirements, automated user management or bespoke security configuration may be chargeable as an enterprise licence add-on.

Automated directory synchronisation is not part of standard setup. Disabling a user in your identity provider stops them signing in to MarTech3D | Engine immediately, because authentication runs through your tenant, but their account record remains until we deactivate it. Please tell us about leavers through your agreed support channel.