TechLabOps

IT Consulting & Professional Services

Identity and single sign-on

One secure sign-in for every application. We design your identity platform, connect cloud and on-premises apps to it and keep sign-in healthy after go-live.

Technology
  • Microsoft Entra ID
  • Microsoft Entra Connect
  • Active Directory
  • LDAP
  • AD FS
  • SAML 2.0
  • OpenID Connect
  • WS-Federation
  • Conditional Access
  • Azure MFA
  • Privileged Identity Management
  • Accops HyID
  • Okta and Ping
  • FIDO2 and passkeys
  • RADIUS

Your situation

Is this what you are looking for?

If any of these sound familiar, this service is for you.

  • Staff keep many passwords for different applications
  • MFA is missing, partial or easy to bypass
  • You still depend on an old AD FS server
  • Leavers keep access to some systems for too long

The work involved

What needs to be done

Whatever the size of the project, these are the steps that decide whether it succeeds.

  1. 1

    List your applications and sign-in methods

    Record every application, how it authenticates today and who owns it. This shows what can use single sign-on and what needs another approach.

  2. 2

    Clean up the directory

    Fix duplicate or stale accounts, naming and group problems in Active Directory before synchronizing them, so errors are not copied to the cloud.

  3. 3

    Design identity, MFA and access policies

    Define roles, Conditional Access rules and admin access, and test new policies in report-only mode before enforcing them.

  4. 4

    Connect applications in waves and communicate

    Integrate applications one group at a time, test sign-in from both directions, and tell users in advance what will change.

  5. 5

    Document, monitor and plan certificate renewals

    Write step-by-step guides for each application, watch sign-in logs, and track certificate expiry dates so sign-in does not fail unexpectedly.

How we can help

How we can help

This is what we do for you, so your team can stay focused on running the business.

Entra ID design and hardening

Tenant design, administrative units, break-glass accounts and a security baseline aligned with Microsoft recommendations.

Ask about this

Hybrid identity

Microsoft Entra Connect or Cloud Sync with Active Directory and LDAP sources, including cleanup, filtering and password hash or pass-through options.

Ask about this

MFA, passwordless and Conditional Access

Phased MFA rollout, FIDO2 keys and Windows Hello for Business, and Conditional Access policies tested in report-only mode before enforcement.

Ask about this

Privileged access

Privileged Identity Management, just-in-time roles and access reviews to cut standing admin rights.

Ask about this

Single sign-on and federation

SAML 2.0, OpenID Connect and WS-Federation SSO for Microsoft 365, Google Workspace, Salesforce and custom apps, with SCIM provisioning and documented, repeatable steps.

Ask about this

AD FS migration and third-party providers

Migration from AD FS to Entra ID, options for apps that use WS-Federation such as Exchange Server, and integration with providers such as Accops HyID.

Ask about this

What is included

The main areas covered inside this service.

Identity platform

  • Microsoft Entra ID
  • Active Directory
  • LDAP
  • Entra Connect and Cloud Sync
  • B2B guest access

Sign-in protocols

  • SAML 2.0
  • OpenID Connect
  • WS-Federation
  • SCIM provisioning

Applications

  • Microsoft 365
  • Google Workspace
  • Salesforce
  • Exchange Server
  • Custom web apps

Hands-on skills

  • ADDS users, groups and OU structure
  • LDAP integration with HySecure and HyWorks
  • AD FS with SAML and WS-Federation
  • Relying party trust setup
  • SSL and token certificate management
  • Entra ID enterprise applications
  • Conditional Access
  • SSO with SAML or OIDC
  • MFA setup with HyID
  • Push and mobile MFA
  • Passwordless sign-in (FIDO2, WebAuthn, passkeys)
  • Federation with Okta or Ping
  • RBAC and password reset procedures

What you get

Outcomes we aim for on every Identity and single sign-on engagement.

Discuss this service

  • Users sign in once, with MFA, across approved apps
  • MFA and Conditional Access enforced without locking users out
  • Fewer standing administrators and a clean audit trail
  • Step-by-step guides for every integrated application

Common questions

Can you work with our existing Active Directory?

Yes. Most engagements start with hybrid identity: we assess your directory, fix issues that block synchronization and then connect it to Entra ID.

Which applications can you integrate?

Any application that supports SAML 2.0, OpenID Connect or WS-Federation, and many others through an application proxy or header-based sign-in.

Will an MFA rollout disrupt our users?

We roll out in waves, start with report-only Conditional Access policies and give you user communication templates so the change is predictable.

Can you document the setup for our team?

Yes. Every integration ships with a screenshot-based guide in the same style as our public documentation.

Related: Architecture and strategy, Cloud strategy and migration, Virtualization and VDI, File servers and storage, Active Directory services. All it consulting & professional services

Have a project in mind?

Tell us what you are trying to achieve. We reply within one business day with next steps.

Start a projectEmail us