Messages XR Enterprise's Connected SSO experience gives every user one account for signing in, verified by email and password or by a supported identity provider, with multi-factor authentication (MFA) added for extra security.
User authentication ensures that only authorized users are accessing school communications. The Connected SSO experience strengthens this by adding a required second verification step and centralizing each user's identity into one account, shared across Finalsite products. For a deeper dive into the user login experience, check out the article "The Connected SSO experience: Log in and manage your account."
The Connected SSO login experience
This article assists main district administrators with the Messages XR Enterprise Connected SSO experience. Need help understanding the legacy login experience? Check out "Authentication in Messages XR Enterprise: The legacy login experience" to learn more.
💡Quick answers
- What does the Connected SSO experience change about authentication? It replaces separate district-configured logins with one account per user, adds multi-factor authentication, and supports signing in through an identity provider like Google or Facebook.
- What is multi-factor authentication (MFA)? A second verification step required in addition to the password: a one-time code sent by email or generated by an authenticator app.
- Do I have to enter a code every time I log in? Not necessarily, checking "Trust this computer" skips the code on that device.
- What if I lose access to my verification code? Use one of the recovery codes saved during setup, or contact the district administrator.
- What happens after 3 failed sign-in attempts? The user is automatically redirected to the Forgot password page and must reset the password by email before trying again.
- Where do I configure Connected SSO settings for my district? Finalsite's Identity team configures these; there is no district self-service. Requests go through the district's Client Success Manager or a Support ticket.
Single sign-on is here!
A Connected SSO experience is rolling out to Messages XR Enterprise districts!
This upgrade includes:
- enhanced security with multi-factor authentication
- support for popular identity providers (IdPs) like Google or Facebook
- a single, modern login experience across Finalsite products
Wondering which login experience you currently have?
If you see this login screen, your district has been upgraded to the Connected SSO experience:
This article covers the Connected SSO experience.
If your district hasn't yet been moved to the Connected SSO experience, you'll still see this legacy login screen:
Learn more in "Authentication in Messages XR Enterprise: The legacy login experience."
What changes with Connected SSO
| Feature | Legacy login experience | Connected SSO experience |
|---|---|---|
| Login credentials | Separate district-configured methods: Facebook, Google, Apple, LDAP, and SAML | One account per user, verified by email and password or by a supported identity provider (IdP) |
| Verification | Password only | Password plus multi-factor authentication (MFA) |
| Password resets | Handled per legacy account through Forgot password | Centralized through Forgot password on the Connected SSO account |
| Failed sign-in attempts | Varies by configuration | Redirects to Forgot password after 3 attempts |
| Session behavior | Not standardized | Trusted-device duration; 60-minute inactivity timeout |
Facebook, Google, Apple, LDAP, and SAML authentication as configured today are superseded by this single, unified sign-in. District administrators no longer configure each method separately in Global Settings as done in the legacy login experience, but reach out to your Finalsite team for assistance.
Signing in: Password or identity provider
Users sign in with:
- Email and password: a single email-based account, or
- An identity provider (IdP): Google, Microsoft/Entra, Apple, Facebook, Okta, Veracross, OIDC, SAML, or LDAP, depending on what the district has requested.
The first time a user signs in under Connected SSO, they claim or link their account. See "The Connected SSO experience: Log in and manage your account" for the full first-login and day-to-day walkthrough.
Multi-factor authentication (MFA)
Multi-factor authentication (MFA) adds a second verification step beyond a password, using either an email code or an authenticator app, so an account stays protected even if a password is compromised. After 3 unsuccessful sign-in attempts, an automatic redirect to the Forgot password page adds a layer of protection against unauthorized access.
Trusted devices
A Trust this computer option lets a device skip the MFA code for a number of days.
Recovery codes
Recovery codes, shown during MFA enrollment, provide a way to regain access if a verification code cannot be received.
Staying signed in
Sessions stay active while in use and end automatically after 60 minutes of inactivity, returning the user to the login page.
Where these settings are configured
Connected SSO settings are configured by Finalsite's Identity team. Requesting setup or changes post-implementation can be requested through your Client Success Manager, by emailing clientsuccess@finalsite.com, or by contacting Finalsite Support.