Secure access with single
sign-on built for your team.

Single sign-on (SSO) is an authentication method that lets mortgage servicing staff log in once through a central identity provider and access all connected applications, such as the core servicing platform, document management, and reporting tools, without re-entering credentials. The identity provider (IdP) verifies the user’s identity and issues a secure token that each connected application trusts. In The Mortgage Office, SSO connects directly to your existing IdP so your team authenticates through the same system your organization already controls.

The Mortgage Office uses SAML-based SSO, meaning you connect your identity provider by entering your entity ID and metadata URL in the Configure SSO section, then enable SSO for each database you want to protect. Once configured, users authenticate through your IdP, either from the TMO login page or directly from your provider’s dashboard, and TMO matches them by email address to grant the correct database access. Authentication and multi-factor verification remain entirely within your identity provider, so your existing security policies apply without any changes to how TMO handles credentials. 

The Mortgage Office supports any SAML-based identity provider, with Microsoft Entra ID (formerly Azure AD) and Okta explicitly supported out of the box. This means mortgage servicers can bring TMO into their existing identity stack without replacing or reconfiguring their current IdP.

To connect The Mortgage Office to your identity provider, you need two pieces of information from your IdP: your entity ID and your metadata URL. You enter both in the Configure SSO section of TMO, which establishes the trust relationship between your IdP and the platform. Once that connection is in place, you can enable SSO on a per-database basis and map users by their email address to control which databases each person can access.

Yes, TMO lets you configure SSO at the individual database level, so you can require identity provider authentication for some databases while leaving others on standard login. This per-database control is useful for organizations that are rolling out SSO in phases or that have different security requirements across portfolios or business units. Each database can be independently scoped, giving administrators precise control over which users authenticate through the IdP and which do not.

Single sign-on and multi-factor authentication (MFA) solve different problems: SSO centralizes access so users authenticate once to reach multiple applications, while MFA strengthens that authentication by requiring a second verification factor such as an app push or one-time code. In The Mortgage Office’s SSO model, MFA is enforced at the identity provider level, meaning one MFA challenge at login covers all SSO-protected databases without requiring separate MFA configurations per application. This approach lets mortgage servicers enforce a zero-trust security posture through their existing IdP without adding friction inside TMO itself.

SSO is more secure than managing separate credentials per application because it eliminates password reuse across systems, centralizes enforcement of password policies and lockout rules, and makes deprovisioning immediate, disabling one IdP account cuts off access to all connected applications at once. Separate per-application passwords create orphaned accounts and inconsistent policy enforcement, both of which are common audit findings in regulated mortgage servicing environments. When paired with MFA at the identity provider, SSO supports a zero-trust posture that is significantly stronger than distributed credential management.

When an employee leaves, disabling their account in the identity provider immediately revokes access to every application connected through SSO, including all TMO databases, no manual cleanup is required in each system. Role changes are handled the same way: updating the user’s groups or attributes in the IdP propagates the change to TMO through the SSO session, eliminating orphaned accounts and reducing the risk of over-privileged access. This centralized deprovisioning model directly addresses a common compliance gap in mortgage servicing environments where staff turnover is frequent.

The Mortgage Office maps each authenticated user to specific databases by matching their identity provider email to the corresponding user record in TMO, then applies the database-level access permissions already configured for that user. This means SSO handles authentication while TMO retains control over authorization, who can access which database and with what permissions, keeping the two concerns cleanly separated. Administrators manage database access assignments inside TMO and manage authentication policy inside their IdP, with no overlap or conflict between the two systems.

The most effective rollout approach is to enable SSO on a per-database basis in The Mortgage Office, starting with a pilot group, before enforcing it organization-wide. This lets you validate email matching, IdP configuration, and MFA behavior without affecting all users at once. Before go-live, confirm that every user’s email address in TMO matches the identity attribute their IdP will send, and communicate clearly which login flow users should expect so they are not confused by the redirect to the IdP. Keeping direct-login access available during the transition period gives administrators a fallback while SSO is being validated across all databases.