# Allow Users to Log in to the Cloud Voice App with SSO

With Single Sign-on (SSO) enabled, users you've synchronized from Microsoft Entra ID can sign in to the Cloud Voice App using their existing Microsoft credentials, instead of managing a separate extension login. This page walks you through turning on SSO and choosing how synced users authenticate.

:::caution
Using the Cloud Voice App inside Microsoft Teams is a special case. Because of a Microsoft restriction, SSO sign-in through the Microsoft Teams integration is only supported on a limited set of PBX root domains. Standard SSO to the desktop, mobile, and web apps (the procedure below) is not affected. If you plan to offer SSO through the Teams integration, confirm your deployment's root domain qualifies before you roll it out.
:::

## Before you begin

- Connect Cloud Voice to Microsoft Entra ID. The procedure depends on your system's firmware version:
  - Running **84.22.0.138 or later**: [Integrate Cloud Voice with Microsoft Entra ID](/pbx/integrations/azure-ad/integrate-cloud-voice-cloud-voice-with-azure-active-directory/).
  - Running a build **earlier than 84.22.0.138**: [Integrate Cloud Voice with Microsoft Entra ID (Legacy)](/pbx/integrations/azure-ad/integrate-cloud-voice-cloud-voice-with-azure-active-directory-legacy/).
- [Synchronize your Microsoft Entra ID users to Cloud Voice](/pbx/integrations/azure-ad/synchronize-azure-ad-users-to-cloud-voice-cloud-voice/), so the matching extensions already exist.

## Turn on Single Sign-on

1. Sign in to the PBX web portal and go to **Integrations > Collaboration**.
2. In the **Single Sign-on (SSO)** section, switch the feature on.

   ![The Single Sign-on toggle switched on in the Collaboration settings](/images/pbx/turn-on-sso.png)

   :::note
   Before the app can complete an SSO sign-in, the Client SSO Redirect URI must be present on your Microsoft Entra application. If you haven't added it yet, see [Add the Client SSO Redirect URI](/pbx/integrations/azure-ad/integrate-cloud-voice-cloud-voice-with-azure-active-directory-legacy/#integrate_azure_active_directory_with_yeastar_p_series_pbx__section_vj1_ydx_j5b).
   :::

   ![The Cloud Voice App sign-in page showing the Microsoft single sign-on option](/images/pbx/sso-login-cloud.png)

3. Optional: From the **Login Method** drop-down list, choose how synced users are allowed to authenticate.

   ![The Login Method drop-down list with its two authentication options](/images/pbx/sso-login-method.png)

   - **Allow users to log in via SSO or using the PBX credential**: Users can sign in either through SSO or with the account credentials of their associated extension.
   - **Enforce SSO login only**: Users can sign in only through SSO.
4. Click **Save**.

## Result

Synced users can now sign in to the Cloud Voice App directly with their Microsoft accounts.

:::note
SSO on the mobile and desktop apps requires an up-to-date app version:

- Cloud Voice App for Android: version 5.21.7 or later
- Cloud Voice App for iOS: version 5.21.3 or later
- Cloud Voice App for Windows (desktop): version 1.18.5 or later
- Cloud Voice App for Mac (desktop): version 1.18.5 or later
:::

![Cloud Voice, a user signing in to the app with their Microsoft account](/images/pbx/sso-cloud.png)