topic Re: MSP-style login for SSO account in Cloud Networking Platform

MSP-style login for SSO account

dunky — Fri, 06 Mar 2026 14:58:07 GMT

We have two organizations both using Azure SSO in different tenancies

I want to be able to login with my SSO email address and be presented with a choice of organizations.

My account has been 'guested in' to the other orgs Azure ok.

I can login to each org via their specific URL, i.e. org1.sso.meraki.com and org2.sso.meraki.com

All I see when I login though is the org I've logged into. I want the choice to select the required org once I've logged in.

I'm obviously missing something?

TIA

Re: MSP-style login for SSO account

mloraditch — Fri, 06 Mar 2026 15:02:11 GMT

I'm thinking it may be because of the subdomains being defined. We leave that blank and can see all our sso enabled orgs from one account when they share the same fingerprint and login url.

Re: MSP-style login for SSO account

dunky — Fri, 06 Mar 2026 15:05:20 GMT

Could you explain that a little more please @mloraditch ?

What do you mean when you say you leave your subdomains blank?

Re: MSP-style login for SSO account

mloraditch — Fri, 06 Mar 2026 15:54:27 GMT

See below, I'm referring to the SSO Subdomain field

Re: MSP-style login for SSO account

dunky — Fri, 06 Mar 2026 16:05:58 GMT

Ahh I see what you mean now, but that raises even more questions...

So simply remove the subdomain?

What URL would we use then to login to the dashboard?

When logging into Vision Portal I assume we would still click on "Log in with SAML SSO"? But then isa asks for subdomain.

What subdomain would we enter in the app?

I really appreciate you taking your time to assist

Re: MSP-style login for SSO account

mloraditch — Fri, 06 Mar 2026 16:23:01 GMT

You can initiate from here https://myapps.microsoft.com. as long as you have the Enterprise app visible to your users.

I don't use cameras at all so I can't answer regarding the Vision portal. @Philip D'Ath may be able to help when he's next online (it's already the weekend in NZ). He's done a lot of SSO and helped a number of others on threads through the years.

Re: MSP-style login for SSO account

dunky — Fri, 06 Mar 2026 16:29:43 GMT

Thanks @mloraditch

Its weekend here in 30mins too 😀

Hopefully Philip may be able to guide me.

Its annoying that I cant find any official Meraki documentation outlining how to achieve this.

Re: MSP-style login for SSO account

JamesT91 — Fri, 06 Mar 2026 16:35:58 GMT

And to save yourself having to go via MyApps first, you can right-click>copy link on the app and then add that URL as your bookmark 😊

Re: MSP-style login for SSO account

Philip D'Ath — Wed, 11 Mar 2026 18:50:09 GMT

>We have two organizations both using Azure SSO in different tenancies

To be clear, are you talking about two different Azure tenancies here?

And you have different logins for each of the two Azures?

Re: MSP-style login for SSO account

dunky — Thu, 12 Mar 2026 09:45:02 GMT

Hi Philip,

Yes, they are two separate Azure organizations.

I have one SAML login in Org A, that same account is guested in to Org B's organization

Re: MSP-style login for SSO account

Philip D'Ath — Thu, 12 Mar 2026 19:27:05 GMT

I do not believe this approach will work.

Fundamentally, an Entra account is only authenticated in one tenancy. The one where it was created. When you add it as a guest to another tenancy, that tenancy does not authenticate the guest user itself; it relies on that authentication being forwarded from the tenancy where the user is actually hosted.

The Meraki Dashboard cannot ask the Entra tenant associated with your guest account to authenticate you. Only the source tenant can do that.

A better solution would be to add your Entra to their Meraki Dashboard. To do this is as simple as copying that SHA1 fingerprint from your existing dashboard to their dashboard, like this (this tenant has three SAML authentication sources!).

And then add the SAML roles you use to their system. I tend to do a lot of SAML work in general, so I tend to name my roles:

In the example below, IFM is the MSP. This role is intended to authenticate access to the Meraki Dashboard, and this is intended to provide Administrator access. This makes it very clear to anyone looking at the logs which company accessed their system, and who it was.

Also, if you are using Entra, use the "mysigns" style to access the Meraki Dashboard. This is the most powerful way to gain access (and very quick, just two mouse clicks).

Re: MSP-style login for SSO account

dunky — Thu, 19 Mar 2026 16:08:22 GMT

Thanks Philip, Will give it a go.

Re: MSP-style login for SSO account

nickster36 — Wed, 01 Apr 2026 14:22:40 GMT

Hi @mloraditch,

Thanks - so in your screenshot the SSO Subdomain field is empty. Is that intentional, and is that what allows you to see multiple orgs when you log in?

Re: MSP-style login for SSO account

nickster36 — Wed, 01 Apr 2026 15:11:28 GMT

Hi Philip,

Following your advice, we have:

- Copied the org 1 SHA1 fingerprint into org 2
- Created matching SAML roles in both orgs
- Confirmed no duplicate local admin accounts exist in either org
- Initiated login via https://myapps.microsoft.com

However we're not getting the org switcher - we just land in one org with no option to select the other.

A couple of questions if you don't mind:

1. Does it make any difference that we're in a Multi-Tenant Organisation (MTO) setup in Entra?

2. Is the SSO Subdomain field relevant here - should it be populated or left blank (I notice it's populated in your example?

Many thanks

Re: MSP-style login for SSO account

Philip D'Ath — Wed, 01 Apr 2026 23:55:21 GMT

>Does it make any difference that we're in a Multi-Tenant Organisation (MTO) setup in Entra?

I have not personally done an MTO in Entra - but this should make zero difference based on my understanding.

> Is the SSO Subdomain field relevant here

It is not relevant and is not used for this config. It won't matter if it is populated or not.

Do you at least get the Organisation drop-down box when you log in?

Re: MSP-style login for SSO account

Philip D'Ath — Thu, 02 Apr 2026 00:06:00 GMT

I just checked one of the client tenants I have configured. I noticed I have also filled in the "SSO login URL". I don't believe this is required, but that is worth trying.

Also note that if they are on different shards, after you copy and paste in the SHA-1 fingerprint, that a global Meraki replication is required before you gain access to that extra client. That usually completes within 10 minutes. Maybe try using it again, before making any changes.

Re: MSP-style login for SSO account

nickster36 — Thu, 02 Apr 2026 07:42:06 GMT

Hi Philip,

Thanks very much for the quick reply, much appreciated.

To answer your question - no, we do not get the Organisation drop-down at all. We just land straight into one org.

We believe we are on different shards - the Consumer URLs have different node numbers. We'll try again after the Easter break and allow more time for replication before testing, and will let you know the outcome 🙂

Thanks again

Re: MSP-style login for SSO account

dunky — Thu, 02 Apr 2026 08:34:34 GMT

Thanks @Philip D'Ath That's now working a treat.

The organizations are on different shards and its working this morning so as you say it was just a matter of waiting for the Meraki replication.

Very much appreciated your help on getting this working.

Re: MSP-style login for SSO account

nickster36 — Thu, 02 Apr 2026 08:38:56 GMT

Hi Phil,

We left it overnight and it's now working properly, suggesting the extra replication time did the trick!

Many thanks for your help!