How Acquisitions Affect SSO Login and User Accounts with Entra ID
An acquisition can affect how Newforma Konekt identifies and manages users, depending on whether the two companies’ Microsoft tenants are kept separate or merged, and whether acquired users already had a presence in the acquiring tenant.
How Newforma Konekt Identifies You
When a user logs in with SSO, Newforma Konekt uses two pieces of information to identify their account: their email address, and a unique identifier assigned by Microsoft called an Object ID. The Object ID is specific to the Microsoft tenant a company uses. It does not change when a user’s email address changes, but it does change when a user is moved from one Microsoft tenant to another.
Konekt stores a user’s Object ID the first time they log in with SSO and uses it to match their Microsoft identity to their Konekt account on all subsequent logins. If a user’s Object ID changes, Konekt’s authentication system detects the mismatch on their next login and initiates a one-time account re-linking process, prompting the user to confirm the link before continuing.
Status of Tenants
Tenants Kept Separate
If an acquisition does not merge the two companies’ Microsoft tenants, SSO can be enforced for both tenants from the Hub Settings page.
Domains Merged into One Tenant
If an acquisition results in the acquired company’s domain being merged into the parent company’s tenant, users from the acquired tenant need to be migrated. This means deprovisioning their original Entra ID accounts and provisioning new ones under the new tenant.
Status of Acquired Users
If Acquired Users Were Already Guest Users in the Acquiring Tenant
Microsoft’s External-to-Internal Conversion feature can convert a guest account to an internal account within the parent tenant, preserving the user’s Object ID. From Newforma Konekt’s perspective, nothing changes: the identity remains the same, no re-linking prompt appears, and there is no disruption to login.
If the acquired domain is migrated to the parent tenant alongside this guest conversion, login attempts will fail while the new domain is being verified in the new Microsoft tenant. This is expected and temporary.
If Acquired Users Appear as External Users in the Parent Tenant (Without Conversion)
These users can be synced to Newforma Konekt, but their SSO access is scoped only to the specific hub connected to the parent tenant. If the parent company removes their access, they lose login access to that hub, but retain any access they have through other hubs or tenants.
To fully remove an external user’s access to Newforma Konekt, the parent company must either manage the user directly in the subsidiary’s own Entra ID tenant, or complete Microsoft’s conversion process to make them an internal user. The user’s access will be updated automatically.
If Acquired Users Had No Prior Presence in the Acquiring Tenant
New accounts must be created for these users in the acquiring tenant. All new accounts will have new Object IDs.
Users that already had an existing Newforma Konekt account before the acquisition can still be matched to their new Object ID.
If their email address stays the same, Newforma Konekt falls back to the email address to locate the existing account and displays a one-time re-linking prompt on first login.
If the email address also changes as part of the migration, neither the new Object ID nor the new email address will match automatically. Newforma Support must update the user’s email address in Konekt in advance of their first login, or the account will need to be re-linked manually afterward.
The organization’s IT team must also approve the Newforma Konekt application in the new Microsoft tenant before these users attempt to log in for the first time.
What To Do
- If tenants are kept separate: No action required for login.
- If domains are merged and users were already guest users in the acquiring tenant: Your IT administrator must use Microsoft’s External-to-Internal Conversion feature to convert a guest account to an internal account within the parent tenant Login can then proceed normally.
- If domains are merged and users had no prior presence in the acquiring tenant: Your IT administrator must approve the Newforma Konekt application in the new Microsoft tenant before these users attempt to log in for the first time. If the user’s email address is also changing, contact Newforma Support to update it in Konekt in advance of their first login.
- Logging in: Confirm the “Link Newforma Konekt Account” prompt on first login, where applicable. This links the account, and no further action would be required of you.