How a Microsoft Tenant Change Affects SSO Login
Some companies move to a new Microsoft tenant, whether as part of an IT infrastructure change or an acquisition. This affects how Newforma Konekt identifies you during SSO login, and requires a one-time re-linking step.
How Newforma Konekt Identifies You
When you log in with SSO, Newforma Konekt uses two pieces of information to identify your account: your email address, and a unique identifier assigned by Microsoft called an Object ID. The Object ID is specific to the Microsoft tenant your company uses.
Moving to a new Microsoft tenant changes your Object ID, since the Object ID is tied to the tenant itself.
The Re-Linking Process
When your Object ID changes, Newforma Konekt’s authentication system detects the mismatch on your next login and initiates a one-time account re-linking process. What happens next depends on whether your email address also changes as part of the move.
If Your Email Stays the Same
Newforma Konekt’s authentication server finds that the Object ID doesn’t match the one stored for your account, falls back to your email address, and locates your existing account. A re-linking prompt appears; confirming it links your new Object ID to your existing account. Your account, projects, and data are unaffected, and this step occurs only once.
If Your Email Also Changes
Neither your Object ID nor your email address will match automatically, since both have changed. Newforma Support needs to update your email address in Konekt in advance of your first login. Once that’s done, Newforma Konekt will find your account by the updated email address and display a re-linking prompt. Confirming it links your new Object ID to your existing account. Your account, projects, and data are unaffected, and this step occurs only once.
The Domain Verification Window And Exclusivity
If your email address is changing along with the tenant, it’s usually because your company is also moving to a new domain. The new domain must be added and verified in the new Microsoft tenant by your organization’s IT administrator before it can be used for authentication. Meanwhile, when the old domain is removed from the old Microsoft tenant, Microsoft invalidates it as an authentication domain and updates all associated user accounts to a temporary @onmicrosoft.com address.
During the period between domain removal and this verification, the domain does not exist in any Microsoft tenant, and SSO login attempts to Newforma Konekt will fail. This is expected and temporary. Wait until your IT administrator has completed domain verification before attempting to log in.
Furthermore, a domain can only be associated with one Microsoft tenant at a time. Attempting to connect a domain that is already linked to another tenant will fail. This is relevant whenever a domain is being moved to a new tenant as part of the migration..
What To Do
- Before the migration: Your IT team must approve the Newforma Konekt application in the new Microsoft tenant before users attempt to log in for the first time.
- If your email address is changing: Contact Newforma Support to update your email address in Konekt before logging in. If a new domain is involved, wait until your IT administrator has completed domain verification before attempting to log in.
- Logging in: Confirm the re-linking prompt on your first login. This links your account and requires no further action.