My1Login and Microsoft: 8 things to consider when choosing identity and access management

Most organisations that run Microsoft 365 already have Microsoft Entra ID as their directory and identity provider. It does that job well: users, groups and devices in one place, Conditional Access and MFA at sign-in, and single sign-on for apps that support SAML or OpenID Connect.

So the question for most IT teams isn't whether to replace Entra ID. It's what Entra ID leaves uncovered: the apps that only take a username and password, Windows desktop and legacy systems, shared accounts, one-time codes and the apps nobody told IT about. Those gaps are where passwords get reused, written down and phished.

Here are eight things to consider when choosing identity and access management, and how My1Login works alongside Entra ID to close those gaps. Entra ID stays your directory. With Zero Login, people sign in to Entra ID or Active Directory as they do now, and that signs them in to My1Login too.

1. Which apps does single sign-on actually reach?

Single sign-on built on SAML and OpenID Connect works well for the apps that support those standards. Many business apps don't: web apps with only a username and password, Windows desktop software, Citrix sessions, mainframe emulators and in-house systems. They're especially common in financial services, the public sector, utilities and accountancy.

If single sign-on only covers some apps, people go back to reusing and writing down passwords for the rest. My1Login signs people in to password-only web apps and Windows desktop apps, with no API needed, so the experience is the same for every app. It can also handle SAML and OpenID Connect apps itself if you prefer to manage them in one place. The app catalogue lists 20,000+ apps ready to connect.

2. Passwords on the apps that still need them

Where an app still needs a password, the safest password is one nobody knows. My1Login generates long, random passwords for each app, changes them in line with the policy you set for that app, and fills them in for people without showing them. "Show password" is blocked on sign-in pages, so passwords stay hidden.

People can't be phished for passwords they don't know, and they can't use them outside My1Login. When someone leaves and their directory account is disabled, they lose access to every app at once, with no passwords left behind.

3. Shared and privileged accounts

Most organisations have accounts that several people need: social media, supplier portals, admin and service accounts, government portals. My1Login's enterprise password manager shares access to them with individuals or teams without revealing the password, whether from IT to people or between colleagues, and records every use in the audit trail.

Many shared accounts also ask for a one-time code. My1Login generates and fills in authenticator codes for everyone allowed to use the account, so a team can share an account protected by MFA without passing a phone around.

4. Shadow IT: the apps nobody told IT about

Teams adopt cloud apps without asking IT, and an identity provider only protects the apps that have been added to it. My1Login finds the apps in use across the organisation, including those IT didn't know about, and lets administrators add them in one click. It also reports the apps where people are being asked for one-time codes, which helps with compliance audits.

5. Who can read stored passwords?

Any tool that stores passwords for you should answer one question clearly: who holds the keys? My1Login encrypts credentials on the client, with AES-256 keys that stay inside your network. Only encrypted data reaches My1Login, so nobody outside your organisation can read your stored passwords, including My1Login.

My1Login holds Cyber Essentials Plus, runs on ISO 27001-certified hosting, and is penetration tested by CREST-approved testers, who rate it A+, "suitable for use in defence and other high security industries".

6. Adoption: a tool people don't use protects nothing

Password managers and portals only protect the people who install them, enrol and remember to use them. With Zero Login, people are signed in to My1Login when they sign in to Entra ID or Active Directory. With Zero UI, it runs in the background, so your workforce won't even know they're using it. Everyone is covered from their first sign-in, with nothing to install, register or learn.

That's why My1Login can guarantee adoption: user adoption is guaranteed where Zero Login has been deployed and provisioned users have signed in to the corporate directory.

7. Deployment and day-to-day effort

My1Login connects to the Entra ID or Active Directory you already run, so there's no directory migration. It's delivered as a service, with nothing to host. New web apps can be added by their address, apps found by discovery are added in one click, and My1Login learns each person's sign-in details the next time they sign in. Desktop apps need some simple set-up, and our Customer Success team helps with it.

8. The cost of the gaps

The cost of identity isn't only licences. It's password reset tickets, the time people lose signing in to apps one at a time, the risk of phished and reused passwords, and the extra tools bought to cover what single sign-on misses.

My1Login is priced per user, per month, for each module you need: single sign-on for web, single sign-on for desktop, the enterprise password manager, MFA and one-time codes, and user provisioning. Our ROI calculator estimates the savings for your organisation.

In conclusion: keep Entra ID, close the gaps

Entra ID is a strong directory and identity provider for apps that support modern standards. My1Login works alongside it to reach the rest:

The result is one sign-in for every app your workforce uses, with every access recorded and nothing new for people to learn. To see it working on your own apps, book a 5-minute demo or start a 14-day free trial.