Single Sign-On (SSO) lets your staff and patrons sign in to Surpass Cloud with an account your organization already uses, such as a school or district Microsoft 365 account, so they don't need a separate Surpass password. Go to Settings : Security : Single Sign-On (SSO) to set it up.
Surpass currently supports Microsoft Entra ID (Microsoft 365 / Azure AD). Support for more identity providers is coming soon.
Only users with the Single Sign-On (SSO) security setting permission can view or change this page.
Where SSO Works
| Application | SSO Available |
|---|---|
| Surpass Cloud Admin | Yes (staff accounts only, see Who Can Sign In) |
| Surpass Cloud Search (OPAC) | Yes |
| Surpass Self-Check | No |
Self-Check stations are often shared, public devices, so a Microsoft sign-in could stay active for the next person. Self-Check users keep signing in with their usual ID or email and password.
Settings
Select Microsoft Entra ID in the provider list on the left to see its settings. The green or gray dot next to the provider, and the Enabled / Disabled badge, show whether it is turned on.
A Save button appears in the panel header after you make a change. Click it to apply your changes.
- Enable Microsoft SSO - Shows a Sign in with Microsoft button on the Surpass Cloud Admin and Surpass Cloud Search login pages. The remaining settings appear when this box is checked. Unchecking it hides the button, and users sign in with their Surpass ID or email and password as usual.
- Microsoft Tenant ID (optional) - Restricts sign-in to accounts from your organization's Microsoft 365 directory. Leave it empty to accept any Microsoft account. The Tenant ID is a GUID, for example
12345678-1234-1234-1234-123456789012. Your Microsoft 365 administrator can find it in the Microsoft Entra admin center under Overview : Tenant ID. - Allowed Email Domains (optional) - A comma-separated list of email domains that may use SSO, for example
school.edu, district.org. Leave it empty to allow any domain. Users whose Microsoft email doesn't end in one of these domains are blocked with the message "Your email domain is not authorized for this library." - Auto-provision new users - If no Surpass account matches the user's Microsoft email address, Surpass creates a new patron account for them. Leave it unchecked to allow sign-in only for people who already have an account. Anyone else sees "No account found with this email address." Three more settings appear when this box is checked:
- Default Role - The role assigned to new accounts. If you leave it at -- Select Role --, new accounts get the Patron role.
- Default Location - The home location for new accounts.
- Default Patron Type - The patron type for new accounts.
Default Location and Default Patron Type are filled in with the first item in each list, which may not be what you want (for example, a patron type of Administrator). Check both before you click Save.
For the most control, enter your Microsoft Tenant ID and also list your Allowed Email Domains. The Tenant ID limits sign-in to your organization's directory, and the domain list limits which email addresses within it can use SSO.
Signing In with Microsoft
When Microsoft SSO is enabled, a Microsoft button is added to the login screens of Surpass Cloud Admin and Surpass Cloud Search. The regular login stays available in both.
Surpass Cloud Admin
The login page shows a Sign in with Microsoft button below the regular Sign In button.
- On the login page, click Sign in with Microsoft.
- Sign in on the Microsoft page with your work or school account. If you're already signed in to Microsoft 365 in this browser, this step may be skipped.
- You are returned to Surpass Cloud Admin and signed in.
Surpass Cloud Search (OPAC)
The Log In With window shows a Microsoft button above the patron number or email field. If Facebook or Google login is turned on for your catalog, the Microsoft button appears below those buttons.
- Click Log In in Surpass Cloud Search, then click Microsoft.
- Sign in on the Microsoft page with your work or school account. If you're already signed in to Microsoft 365 in this browser, this step may be skipped.
- You are returned to Surpass Cloud Search and signed in. A "Signing you in with Microsoft..." message shows while sign-in finishes.
Facebook and Google login for Surpass Cloud Search are separate patron login options, and they aren't controlled by the Single Sign-On page.
After you turn Microsoft SSO on or off, it can take a short time for the change to appear on the Surpass Cloud Search login window.
How Surpass Finds Your Account
- First sign-in - Surpass looks for an account whose email address matches your Microsoft email (matching ignores upper and lower case). If it finds one, it links your Microsoft account to that Surpass account.
- Later sign-ins - Surpass recognizes the linked Microsoft account directly, even if the email address on the Surpass account changes later.
- No match - If Auto-provision new users is checked, Surpass creates a new account using your Microsoft name and email. Otherwise sign-in fails.
Each email address should belong to only one Surpass account. If several accounts share the same email address, Surpass may link to the wrong account, for example an inactive duplicate.
Who Can Sign In
- Surpass Cloud Admin - Only staff accounts can use SSO. Accounts with the Patron or No Access role are blocked with the message "Single Sign-On is only available for staff accounts."
- Surpass Cloud Search (OPAC) - Any account with a matching email can sign in, including patrons.
If you use Auto-provision new users and leave Default Role blank (or set it to Patron), new accounts can sign in to Surpass Cloud Search but not to Surpass Cloud Admin. To let new staff sign in to Admin on their first visit, choose a staff role as the Default Role. Auto-provisioning still counts against your subscription's patron limit.
Troubleshooting
| Message or Error | What It Means | What to Do |
|---|---|---|
| Your email domain is not authorized for this library. | The user's Microsoft email domain isn't in Allowed Email Domains. | Add the domain to the list, or clear the list to allow all domains. |
| No account found with this email address. | No Surpass account has this email, and auto-provisioning is off. | Add the email address to the user's Surpass account, or turn on Auto-provision new users. |
| Single Sign-On is only available for staff accounts. | The account has the Patron or No Access role, and the user is signing in to Surpass Cloud Admin. | Assign a staff role if the user needs Admin access. Check for duplicate or inactive accounts with the same email. |
| Single Sign-On is not enabled for this library. | Microsoft SSO is turned off. | Check Enable Microsoft SSO and click Save. |
| Sign-in fails right after the Microsoft page, or with an invalid sign-in error | Microsoft didn't accept the sign-in, or the account isn't in the directory set by Microsoft Tenant ID. | Confirm the Tenant ID is correct, or clear it to allow any Microsoft account. Your Microsoft 365 administrator may also need to approve the Surpass app for your organization. |
| Sign in with Microsoft button doesn't appear | SSO isn't enabled, or the settings weren't saved. | Check Enable Microsoft SSO, click Save, and reload the login page. |
Coming Soon
Microsoft Entra ID is the first supported provider. Support for more identity providers is coming soon, and they'll appear in the provider list on this page when available.