Support for Multiple Account Types with Entra ID


This documentation provides information using multiple accounts with Entra ID.  The intended audience is primarily application owners.

Entra ID has access to more types of accounts than the Unity Shibboleth environment does.  Shibboleth is limited to just Unity accounts, whereas Entra ID has the ability to authenticate service accounts, administrative accounts, and Entra ID Guest accounts.  This means that application owners will have the option of supporting multiple types of accounts depending on their use case.

This means that a user might need to login to multiple accounts in the same browser.  Many applications are integrated in such a way that the end user is presented with an account picker that lets them choose which user to authenticate to the application with.  Some applications assume that the last account that you logged in with is the one that it should use.  Some will only present an account picker if multiple authentication sessions exist.  There is some variability in the user experience of how the end user is prompted.

What if the application isn't letting me choose which account to use?

If an application does not default to using an account picker and you need to switch what account you are using, you can login to https://go.ncsu.edu/entra-attributes as we have modified the redirect parameters for that app to always enforce an account picker.  So you can login to that application with whatever account you need to use, and then return to the application that you were originally needing to access.  Optionally, you can use an incognito window for logging into the original application and when there is no authentication session, you should be able to choose what account.

How can I force that behavior?

As an end user, you cannot force all applications to ask which account to use, but it may be able to be forced by the application owner who is configuring the integration on an application by application basis.

As an application owner, if you have the ability to directly configure the redirect URI for authenticating to Entra ID and you want to force the use of the account picker, you can add the following parameter to that URI:
&prompt=select_account