Table of Contents:
Introduction
This guide explains how to connect PracSuite to your organisation's identity provider so your users can sign in with their existing organisational work account using Single Sign-On. This should be actioned by the System Administrator of your PracSuite account, and the administrator of your Microsoft Entra or Google Workspace account.
What is Single Sign-On (SSO)?
Single Sign-On (SSO) lets your staff sign in to PracSuite using the same account they already use for email and other work apps, such as a Microsoft (Entra ID) or Google Workspace account. Instead of a separate PracSuite password, PracSuite hands the sign-in to your identity provider (IdP), which confirms who the user is and sends them back.
Benefits for your practice:
One account to manage. Staff sign in with their organisational work account, so there is one less password to remember or reset.
Your security policies apply. Multi-factor authentication, password rules and sign-in restrictions configured in your IdP apply to PracSuite sign-ins too.
Simpler offboarding. Disabling a user in your IdP stops them signing in to PracSuite again (if you choose to allow logins via SSO only in PracSuite).
Users still need to exist in PracSuite.
Single Sign-On (SSO) controls how a user signs in; it does not create PracSuite users automatically. Please make sure the users have been created in PracSuite with an email address matching your identity provider.
Enabling Single Sign-On
SSO is set up in Settings > Users & Security > Single Sign-On. Only System Administrators can view and change this page.
The SSO page has three parts:
Enable SSO toggle: turns SSO on or off for all databases on your PracSuite account.
Login requirement: whether your organisation requires SSO, or allows staff to choose SSO or password. Individual users can be exempted (see SSO Overrides).
SSO Providers: the identity providers connected to your PracSuite account.
Most practices need only one, but you can add more if different users have different providers.
Adding a new provider
Go to Settings > Users & Security > Single Sign-On and click Add SSO Provider.
Enter a Description for the provider, for example "Microsoft Entra" or "Google Workspace", and select your Identity Provider.
Enter the email domains for this provider, for example yourpractice.com.au.
Staff whose email address ends in one of these domains will be able to use SSO to login to PracSuite. e.g. jane@yourpractice.com.au
In your identity provider, you will need to create a PracSuite SAML application using the details on this page. Complete the Microsoft Entra or Google Workspace setup instructions below.
Tip: Keep this Add Provider page open in another tab so you can copy values between PracSuite and your identity provider.
After creating the SAML application in Microsoft Entra or Google Workspace,
return to this Add Provider page to add your identity provider's SAML metadata, either as a metadata URL or by uploading the metadata XML file.
Click Save, then test the configuration to finalise the provider setup.
How to configure Microsoft Entra
You need a Microsoft Entra account with the Application Administrator or Cloud Application Administrator role.
Tip: Keep the PracSuite Add Single Sign-On Provider page open in another tab so you can copy values between them.
1. Create the enterprise application
Sign in to the Microsoft Entra admin centre.
Go to Enterprise apps and click New application.
Follow the instructions in your identity provider to create a new SAML application:
a) Click Create your own application
b) Enter the name PracSuite SSO
c) Select Integrate any other application you don't find in the gallery (Non-gallery)
d) Click Create.
2. Set up SAML
In the new PracSuite SSO application, go to Single sign-on and choose SAML.
In Basic SAML Configuration, click Edit:
a) Click Add Identifier and enter the 'Identifier (Entity ID)' from PracSuite.
b) Click Add Reply URL and enter the 'Reply URL (Assertion Consumer Service URL)' from PracSuite.
c) Click Save
3. Set the attributes and claims
In Attributes & Claims, click Edit.
Click Unique User Identifier (Name ID)
a) Set the Name identifier format to Persistent
b) Set the Source attribute to user.objectID
PracSuite uses the Entra Object ID to recognise the user, so a renamed or reused email address in Entra cannot sign in as the wrong PracSuite user.
c) Click Save
This will return you to the Attributes & Claims page, where the results should appear as below.
4. Give PracSuite your metadata
Returning to the Single Sign-On page of your Enterprise App, under SAML Certificates, copy the App Federation Metadata Url.
Return to PracSuite and paste this into the App Federation Metadata URL field on the PracSuite provider page.
5. Assign users to your Enterprise App (Entra)
Go to Users and groups in the PracSuite SSO application and click Add user/group.
Assign the users, or groups, who should be able to sign in to PracSuite.
By default, Entra only lets assigned users sign in to the application. Users who are not assigned are blocked by Entra before reaching PracSuite.
6. Return to PracSuite to finalise your Single Sign-On setup
After creating the SAML application in Microsoft Entra, return to the Add Provider page of PracSuite.
Click Save, then use the Test Configuration button to complete the setup.
How to configure Google Workspace
You need a Google Workspace super administrator account.
Tip: Keep the PracSuite Add Single Sign-On Provider page open in another tab so you can copy values between them.
1. Create the SAML app
Sign in to the Google Admin console.
Go to Apps > Web and mobile apps
Click Add app, then Add custom SAML app.
Enter the app name PracSuite SSO and click Continue.
2. Give PracSuite your metadata
On the Google Identity Provider details page, click Download metadata to save the IdP metadata XML file.
Return to the PracSuite provider page and upload this
Click Continue in Google.
3. Enter the PracSuite details
On the Service provider details page, enter:
a) The ACS URL copied from the PracSuite Provider setup page
a) The Entity ID copied from the PracSuite Provider setup pageLeave Signed response unticked.
Set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
Click Continue.
4. Map the email attribute
On the Attribute mapping page, click the Add mapping button 3 times (once for each attribute we are copying from PracSuite).
Map Basic Information > Primary email to the app attribute
email.
Map Basic Information > First Name to the app attribute
given_name.
Map Basic Information > Last Name to the app attribute
family_name.
Click Finish.
5. Turn the app on for your users
Open the PracSuite SSO app and click User access.
Set it to ON for everyone, or turn it on for the organisational units or groups that need PracSuite.
Click Save.
Google Workspace does not offer a permanent user identifier for custom SAML apps, so PracSuite matches Google users by primary email address.
If you rename or reassign an email address in Google, update the matching user in PracSuite at the same time.
6. Return to PracSuite to finalise your Single Sign-On setup
After creating the SAML application in Google Workspace, return to the Add Provider page of PracSuite.
Click Save, then use the Test Configuration button to verify your setup.
SSO Overrides (Users & Security)
On the Single Sign-On settings page, you can choose to allow sign in using:
a) Single Sign-On or PracSuite Password
b) Single Sign-On only
Note that Single Sign-On is an enterprise wide constraint that will affect all databases when operating PracSuite in a multi-database environment.
However, you can override it for individual users - for example to keep a locum or contractor on password sign-in.
To override SSO for individual users in PracSuite:
Open an individual user by clicking their name, then click Edit.
In the security section, enable the Override SSO Login
System Administrators in PracSuite will always be able to login using Single Sign-On or Password, even when the Single Sign-On only option is selected.
Using Single Sign-On (SSO)
This is what your users do to sign in once Single Sign-On is set up.
Go to the PracSuite login page and click Sign in with Single Sign-On.
Enter a work email address, which must belong to a domain you've setup with an SSO provider in PracSuite.
When prompted by Microsoft or Google Workspace, sign in with your work account - completing any MFA your organisation requires.
Important: If you are already signed in to your work account in that browser, this step may happen automatically. Please be conscious of this when using shared devices.
You are returned to PracSuite and the sign-in process completes.
Things to know:
You do not need a PracSuite password or authenticator code to sign in with SSO. Your organisation's own sign-in and MFA policies apply instead.
If your login method allows both Password and SSO, you can choose between using your PracSuite password and Single Sign-On.
You cannot create a new PracSuite account by signing in with SSO. Ask your System Administrator to add you as a user first.
Signing out of PracSuite does not sign you out of your work account:
If you are using a shared device, signing into PracSuite via SSO will authenticate your entire browser session with your identity provider.
i.e. If you use Microsoft Entra to login to PracSuite, your browser is now logged into Microsoft Entra.
When you logout of PracSuite, this will NOT automatically log you out of your Microsoft or Google account. Please ensure you are logging out of these accounts separately, and closing the browser entirely, before walking away from the computer.
For Entra/Google Administrators:
If you are concerned with users not logging out of their work accounts correctly, or if you have shared devices, consider setting up an appropriate access policy within Microsoft Entra or Google Workspace.
When authenticating through your own identity provider, and can apply your own policies as appropriate - which can include forcing re-authentication.
Frequently Asked Questions
Can Smartsoft help me configure Microsoft Entra or Google Workspace?
No. Your identity provider is managed by your organisation, so please ask your IT administrator or IT provider for assistance. Smartsoft support can help with the PracSuite side.
If a user can't sign in with SSO, can Smartsoft help troubleshoot?
Partly. Smartsoft support can check the PracSuite side with one of your System Administrators, such as your SSO settings and the user’s login method.
For problems with a Microsoft or Google password, MFA or account, the user should contact your IT administrator.
Will revoking a user's access in the IdP immediately log them out from PracSuite?
No. This will stop new sign-ins using SSO, but an open PracSuite session continues until it expires or the user signs out. To remove access straight away, also deactivate the user in PracSuite.
Can we change the email address of existing users in PracSuite, so they can start using SSO?
Yes. A System Administrator can change it on the user's page. It must match the email your identity provider sends, and can't already be used by another PracSuite user.
Can we use email subaddressing, such as jane+business@yourpractice.com.au?
Yes. Each PracSuite user needs a unique email address, so staff who work in more than one PracSuite business can use a subaddress for each one. They sign in with their subaddress, and PracSuite matches it to their work account (jane@yourpractice.com.au) in your identity provider. You don't need to set up the subaddress in your identity provider.
Can we use an identity provider other than Entra or Google?
We only support Microsoft Entra and Google Workspace at this time.
Can we connect more than one identity provider?
Yes. Add each as its own SSO provider, with the email domains that should use it.
Are users created in PracSuite automatically when they sign in with SSO?
No. Add the user in PracSuite first, then they can sign in with SSO.
Do SSO users still need a PracSuite authenticator code?
No. Your identity provider's MFA applies instead. We recommend requiring MFA in your identity provider.
What happens if our identity provider is unavailable or offline?
SSO-only users won't be able to sign in while your identity provider is unavailable. System Administrators in PracSuite can always sign in with a PracSuite password, so they will be able to disable the SSO-only restriction temporarily if needed.
What happens if we turn SSO off?
PracSuite shows a list of users who will regain password sign-in for you to review before confirming. Those users will sign in with their PracSuite password and authenticator code.
If there are users who have never signed in with a PracSuite password before, they will need to complete the 'Forgot Password' process.