# How Microsoft Entra ID and Junify differ, and when password-based SSO is enough

If everyone using a shared account has an Entra ID account, guests included, and you need no control after sign-in, Entra ID is enough. Junify covers the rest.

Updated: October 16, 2026

Suppose everyone who uses your shared accounts has a Microsoft Entra ID account, and you don't need to control what happens after sign-in. Then Entra ID's password-based single sign-on (SSO) lets them use those accounts without seeing the password. People outside your company can use it too, once you invite them as guests. Junify covers two other cases. One is shared accounts used by people who have no Entra ID account. The other is accounts that use an authenticator-app code, or where you want to block downloads, record the screen, or close the window remotely after sign-in.

## What Entra ID's password-based SSO does

Entra ID is Microsoft's [identity provider](/guides/access-basics/what-is-idp): the service that holds each employee's work account. SAML and OpenID Connect are standard ways for an app to accept Entra ID's sign-in. With apps that support them, people sign in once with that account and open each app without signing in again. For apps that don't, and that sign in with a username and password, Entra ID offers password-based SSO. It works with cloud apps that have a regular web sign-in page. Entra ID stores the username and password encrypted, and a browser add-on called the My Apps Secure Sign-in Extension fills in the sign-in form. The extension runs in Edge and Chrome.

For a shared account, an admin creates a security group of the people who use it and assigns the app to that group. The admin then enters the shared username and password once, for the whole group. People open the app from My Apps, the page that lists the apps assigned to them, and never see the password. Group owners can add or remove members without going through an admin. For some apps, Entra ID can also change the password on a schedule.

Admins can see in Entra ID's sign-in log who opened the app and when. The sign-in logs can be downloaded as CSV or JSON in every edition.

Microsoft's page on shared accounts lists an Enterprise Mobility Suite (EMS) or Entra ID P1 or P2 license as a requirement for each person who uses them. P1 is included in Microsoft 365 E3, E5, and Business Premium.

## What we checked in Microsoft's documentation

### People without an Entra ID account

My Apps needs an organizational account in Entra ID. To let an outside helper use it, you invite them as a guest (Microsoft calls this B2B collaboration). They then sign in with their own work, school, or social identity. Microsoft notes that sign-in to the extension currently isn't supported for guests invited with a personal Microsoft account.

### Two-step codes and activity after sign-in

Microsoft's pages on password-based SSO don't describe a way for the extension to enter an authenticator-app code. The troubleshooting page lists an app adding multifactor authentication to its sign-in page as one way the fill-in can break. [Sharing two-step verification across a team](/guides/shared-accounts/sharing-two-step-verification) covers the problem in more depth.

The password-based SSO pages also don't describe blocking downloads or recording the screen after sign-in. A separate product, Microsoft Defender for Cloud Apps, can block downloads, copying, and printing in browser sessions. Its list of supported apps covers sign-in through SAML or OpenID Connect and doesn't name password-based SSO apps.

### Staying signed in after someone is removed

Microsoft's guidance says, "Microsoft Entra ID can't directly revoke a session token issued by an application." Continuous access evaluation, which lets an app act on Entra ID events after sign-in, narrows that gap for apps built to use it. Its critical event checks work in any Entra ID organization and react when you disable a user, among other events. They cover Exchange Online, SharePoint Online, and Teams, can take up to 15 minutes, and don't apply to guests. We found no way to end a sign-in in a password-based SSO app.

## What Junify does

In Junify, an admin adds the shared account and picks who may use it. People verify on their own phone with the Junify app, so someone with no Entra ID account or email address can use it too.

The Junify Chrome extension fills in the password, and the person never sees it. If people know the password today, you change it when you move the account, and only Junify holds the new one. After that, once you remove someone's access in Junify, they can't open the account through Junify again.

Junify opens the account in a Chrome incognito window that its extension manages. The app's cookies stay out of the person's everyday Chrome, and closing the window leaves neither the password nor the browsing history on that computer. An admin can close Junify's windows on that computer remotely, which removes the login from that computer. If someone leaves an allowed location or IP address, Junify closes that account's tabs and deletes that app's cookies.

Junify records who used which account and when, person by person, and exports it to CSV. Downloads can be allowed or blocked per account, and uploads send an alert to the admin. Recording, with AI summaries, can be turned on for the accounts that need it. For two-step verification through an authenticator app, Junify enters the code. Text and email codes aren't covered.

## Using Entra ID and Junify together

Keep employee accounts and SAML apps in Entra ID. Shared accounts used only by people with Entra ID accounts, where you don't need control after sign-in, can stay on password-based SSO. Put the rest in Junify. [How to get SSO-like sign-in for SaaS apps without SAML](/guides/access-basics/sso-like-operation-for-non-saml-saas) lays out every option for apps that SAML doesn't reach.

## Which one fits

Everything in the Entra ID column comes from Microsoft Learn. "Not found" means only that we didn't find it there, not that Entra ID can't do it.

| Point | Entra ID (password-based SSO) | Junify |
| --- | --- | --- |
| Apps that support SAML | People sign in with their work account | Leave them with Entra ID |
| Signing in without seeing the password | The extension fills in the login | The extension fills in the login |
| Who can use it | People with an Entra ID account, including invited guests | People who verify with the Junify phone app |
| Record | Who opened which app, and when | Who used which account, and when, by person |
| Window the app opens in | A regular window (the extension isn't supported in incognito or InPrivate) | An incognito window |
| Still signed in after removal | Can't directly end an app's own sign-in; nothing found for password-based SSO apps | Admin closes Junify's windows on that computer; leaving an allowed location or IP closes the tabs and deletes the cookies |
| Authenticator-app codes | Not found | Entered by Junify |
| Downloads after sign-in | Not found for password-based SSO apps (Defender for Cloud Apps covers SAML and OpenID Connect apps) | Allowed or blocked per account |
| Upload alerts and recording | Not found for password-based SSO apps (Defender for Cloud Apps has upload controls for SAML and OpenID Connect apps) | Upload alerts; recording per account |
| What each person needs | The extension in Edge or Chrome (Edge on phones) | The Chrome extension and the Junify phone app |

Entra ID alone is the better choice when everyone who uses a shared account has an Entra ID account and you don't need control after sign-in. Its sign-in log then gives you the record of who opened each app. It also handles people working in Edge or on their phones, and it can change passwords on a schedule for the apps that support it. If every app supports SAML and you can give each person their own account, you don't need Junify.

Junify fits best when several needs meet in one account: people without Entra ID accounts use it, the password must stay hidden, and you need a record by person. The case is stronger when the account also uses an authenticator-app code or needs downloads blocked, the screen recorded, or the window closed remotely.


## Frequently asked questions

**Do we need Junify if we already have Entra ID?**

Not if everyone who uses your shared accounts has an Entra ID account, guests included, and you don't need control after sign-in. Junify covers accounts used by people outside Entra ID and accounts that need download control.

**Can Entra ID share a password without showing it?**

Yes. An admin enters the shared username and password once for a group, and the My Apps extension fills them in. Microsoft requires an EMS or Entra ID P1 or P2 license for each person who uses shared accounts.

**Can people outside the company use it through Entra ID?**

Yes. You invite them as guests in your Entra ID and assign them the app. Guests invited with a personal Microsoft account currently can't sign in to the extension.

**What about accounts that need an authenticator-app code?**

Junify enters authenticator-app codes. We didn't find a way in Microsoft's documentation for password-based SSO to enter them.

**Can we use Entra ID and Junify together?**

Yes. Keep employee accounts and SAML apps in Entra ID. Put shared accounts used by people outside it, or accounts that need control after sign-in, in Junify.

## Sources

- [Microsoft Learn: Sharing accounts and credentials - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-sharing-accounts)
- [Microsoft Learn: Add password-based single sign-on to an application - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-password-single-sign-on-non-gallery-applications)
- [Microsoft Learn: Plan a single sign-on deployment - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/plan-sso-deployment)
- [Microsoft Learn: What is single sign-on in Microsoft Entra ID?](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/what-is-single-sign-on)
- [Microsoft Learn: My Apps portal overview - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/myapps-overview)
- [Microsoft Learn: Troubleshoot password-based single sign-on - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/troubleshoot-password-based-sso)
- [Microsoft Learn: Password-based authentication with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/architecture/auth-password-based-sso)
- [Microsoft Learn: How to download logs in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-download-logs)
- [Microsoft Learn: Microsoft Entra licensing](https://learn.microsoft.com/en-us/entra/fundamentals/licensing)
- [Microsoft Learn: What is Microsoft Entra B2B collaboration?](https://learn.microsoft.com/en-us/entra/external-id/what-is-b2b)
- [Microsoft Learn: Conditional Access app control - Microsoft Defender for Cloud Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad)
- [Microsoft Learn: Revoke user access in an emergency in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access)
- [Microsoft Learn: Continuous access evaluation in Microsoft Entra](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation)
- [16 CFR 14.15, Statement of Policy Regarding Comparative Advertising (Federal Trade Commission)](https://www.govinfo.gov/content/pkg/CFR-2024-title16-vol1/xml/CFR-2024-title16-vol1-sec14-15.xml)
- [How Junify works](https://www.junify.com/product)

## How Junify handles this

**Doing this by hand** Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.

**With Junify** Part-time staff and outside helpers who have no Entra ID account can verify on their own phone and open a shared account from Junify. You change the password when you move the account, and only Junify holds it. When someone leaves, you remove their access in Junify instead of changing and resending the password. Each use is recorded by person, and downloads can be blocked per account.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=access-basics&slug=entra-id-and-junify)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [What's the difference between an audit log and audit evidence?](/guides/access-basics/audit-log-vs-evidence): An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed.
- [What a browser extension can and can't control in access management](/guides/access-basics/browser-extension-access-control-scope): An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach.
- [What work data stays on a personal computer, and how to keep it off](/guides/access-basics/byod-leave-no-business-data): History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.