MSC Integration Docs
Single sign-on
Overview
- Enterprise SSO is supported, with Microsoft Entra ID and other SAML 2.0 identity providers. Setup is self-serve.
- MSC users sign in with Entra ID. Local passwords are disabled, and MSC's MFA and conditional access apply.
- Roles come from MSC's Entra ID groups. Joiners and leavers follow MSC's existing process through SCIM.
Phase: Pilot. MSC owner: Entra ID admin.
Setup
An MSC administrator can set up and manage the SSO connection directly in the Faction platform's settings, without waiting on Faction. Faction can also configure it with MSC's Entra ID admin.
- Faction supplies the SAML metadata and the SCIM endpoint and token. Week 1.
- Entra ID admin creates the enterprise application and assigns MSC groups to it. Week 2.
- Entra ID admin maps each group to a role below and enables SCIM provisioning.
- Faction and MSC IT test sign-in, role assignment and de-provisioning with test users.
Roles
| Role | Can | Cannot |
|---|---|---|
| Sourcing associate | Work own queues; approve RFQs; select sources; No Quote with reason | Change ranking weights or trust settings |
| Sourcing lead | All queues; ranking weights; supplier performance; grant or revoke autonomous status | Administer integrations or credentials |
| Customer-facing rep | Line status and customer-facing notes | See cost, margin, supplier identity or internal notes |
| Administrator (MSC IT) | SSO, API clients, portal credentials, exclusion and hierarchy lists, audit | Act on sourcing lines |
| Auditor | Read and export the full audit trail | Change anything |
| Service account | One per integration, scoped to that integration | Anything else |
Security
- SAML 2.0 sign-in, with SCIM provisioning and de-provisioning.
- Roles are enforced in the Faction platform, the API and embedded components.
- Access is reviewed quarterly and on role change. Faction staff have no standing access.
Frequently asked questions
Can MSC change the SSO configuration later?
Yes. MSC administrators manage the connection themselves in the Faction platform's settings.
Does List Manager sign in through SSO?
No. List Manager uses OAuth 2.0 client credentials, a service-to-service method.
What happens when someone leaves MSC?
SCIM removes their access when they are removed from Entra ID.
MSC provides: the enterprise application, group assignments and SCIM configuration.
Faction handles: SAML and SCIM configuration and role enforcement.