MSPs can configure single sign-on (SSO) in their MSP parent account and access their assigned sub-accounts without having to configure SSO on each sub-account individually.
Important: Enabling SSO for a specific domain applies to anyone signing in with a domain-matching email address.
Any user who logs into Blumira with an email address that matches the domain you use will be prompted with the SSO option after it is enabled. This is true even if the user is not an assigned member of the configured Blumira account.
Sub-account users who are not also assigned users of the parent account (for instance, MSP customers on a different domain) will not be prompted for SSO unless their identity provider is configured in their sub-account. However, because only one SSO connection can be created for a Blumira organization's account, we recommend only connecting with the MSP's identity provider and having customer users continue to use email and password to authenticate.
Reference: See configuration instructions in Configure SSO for your organization.