Log in to Finalsite: The connected SSO experience

Misty Flowers

July 14, 2025 18:47

This article explains Finalsite's connected single sign-on (SSO) login experience, including how to enroll in and use multi-factor authentication (MFA) and how sessions and timeouts work when switching between Finalsite products.

💡Quick answers

What does the connected SSO experience change about logging in? It rolls out single sign-on across Finalsite products, adds multi-factor authentication, and lets users log in through a supported identity provider like Google, Microsoft, or Facebook instead of a separate password for each tool.
Choosing a login method on the new screen? Users can enter an email and password, or select an identity provider such as Google, Microsoft, Facebook, Apple, or SAML, with more providers planned.
What happens after three failed login attempts? The user is redirected to the Forgot password page, and a reset link is sent to their registered email address.
How is multi-factor authentication set up the first time? Steps: enter primary credentials, choose a method of authentication (email or an authenticator app), then enter the one-time code to complete enrollment.
Locked out after too many failed login attempts? The account locks after 3 incorrect password attempts, for 10 minutes. Entering an incorrect multi-factor authentication code does not lock the account, however many times it happens. A second consecutive lockout requires contacting Finalsite Support to regain access.
Can users switch between Finalsite products without logging in again? Yes; once authenticated, the session stays active across products, so no additional credentials are needed while switching.

Single sign-on is here!

A connected SSO experience is now rolling out to all Finalsite clients!

This major upgrade includes:

enhanced security with multi-factor authentication
support for popular identity providers (IdPs) like Google, Microsoft, or Facebook
a modern, consistent login experience across all Finalsite products

When enabled, you and your families will automatically be logged out of your Finalsite products. Upon return, you'll see a newly designed login page.

Wondering which login experience you currently have?

If you see this login screen, you have been upgraded to the connected SSO experience:

Finalsite's new login experience is built to boost security, simplify authentication, and create a seamless gateway across products. Whether you're logging in for the first time or switching between tools, learn more about how to manage the features in this newer login experience in the article, "Log in to Finalsite: The connected SSO experience."

If you are a Finalsite client that has not yet been moved over to the universal, connected SSO screen, you may still see this legacy log in experience:

To learn more about how to manage the legacy login features, check out the article, "Log in to Finalsite: The legacy login experience."

How do I get started with the new connected SSO experience?

Our goal is for all users to eventually transition to a Unified SSO experience to provide a single, seamless login across all Finalsite products.

No action is required now: We are rolling out SSO in waves. You will be informed with a notification and we will reach out if any additional action is needed.
Stay informed: We will provide full documentation and support throughout the transition process.

How the two login experiences compare

Feature	Legacy login experience	Connected SSO experience
Login screens	Separate logins: admin users at yoursite.com/admin, and portal users at yoursite.com/login.	One login screen across Finalsite products.
Login credentials	Native authentication: usernames and passwords are stored and managed in Constituent Manager. External SSO can be added for portal or admin logins.	One account per user. Log in with an email or username and password, or choose an identity provider such as Google, Microsoft, Facebook, Apple, or SAML.
Verification	Password only. Multi-factor authentication (MFA) and stricter password requirements are not supported.	Password plus MFA, by email or an authenticator app.
Password resets	The Forgot Username or Password? link emails the username and a link to set or reset the password. The user then logs in again.	Three failed attempts redirect to the Forgot password page, and a reset link is sent to the registered email.
Failed login attempts	Not specified	The account locks for 10 minutes after 3 incorrect password attempts. An incorrect MFA code never locks the account.
Switching products	Not available	The session stays active across Finalsite products configured with SSO, so no extra credentials are needed.
Session behavior	Not specified	Ends after 20 minutes of inactivity, then redirects to the login page with a message.

Log in to your account

Here is a general overview of how users log in, regardless of which product they start with.

Navigate to the login screen

CMS unified login page.png

Returning users: Log in using credentials or displaying IDP option.
New users: Create an account directly from the login page.
Parents and admins: Will be prompted to verify their email.
Admins: Will no longer receive a system generated password.

Choose login method

Users will be guided to login or create a new account with one of the following options:

Login method	How it works
Email or username and password	Enter your email or username and password. If they are valid, you land on the dashboard. A maximum of 3 attempts is allowed, and three failed attempts redirect to the Forgot password page.
Identity provider (IdP)	Select your provider (Google, Microsoft, Facebook, Apple, or SAML). In the login window that opens, enter your credentials to authenticate.

Troubleshoot login attempts

Users may need to manage failed login attempts or forgotten credentials. Here are a few specifics on this step:

Three failed attempts redirects user to the Forgot password page.
Send reset link is sent to registered email.
User clicks link to go to the Reset password page.
After password reset, user is redirected back to the login page.

Use multi-factor authentication (MFA)

Multi-factor authentication (MFA) provides an extra layer of security beyond just a username and password. This process ensures that only the authorized user can access the account, even if their password is compromised.

Here are the typical steps a user goes through when enrolling in and using MFA (often prompted during initial sign-in or via their Identity Provider):

Log in and enroll with MFA (first login)

This is a one-time process to link a second verification method to your account.

Enter primary credentials (Email/password or IdP).
A setup screen prompts you for the second security layer.
Select your Method of authentication (Email or Authenticator app).

Method	Email	Authenticator app
Setup	Enter an email address, click Send code, enter the one-time code, then click Enable.	Scan the QR code, enter the one-time code from the app, then click Enable.
Code	One-time code sent to your email. It works only once.	Time-based code generated by the app.
Trusted device	Not applicable	Your device is saved as trusted when enrollment finishes.

Method of authentication: Email

Enter an email address and click Send code. This code works only once.
Enter the one-time code from your email into the Verification code field.
Click Enable.

Method of authentication: Authenticator app

Scan the QR code.
Obtain a one-time code from your authenticator app and enter into the Verification code field.
Click Enable.
The system saves your device as trusted, completing enrollment and granting access.

Account lockout warning

The account locks after 3 incorrect password attempts, for 10 minutes. Entering an incorrect multi-factor authentication code does not count toward this and never locks the account. If locked out twice consecutively, contact Finalsite Support to regain access.

Troubleshoot a multi-factor authentication code that won't work

A wrong or rejected code is never a lockout, so there's no need to wait. A few things resolve most cases:

What you see	Likely cause	What to do
Code looks right but is rejected	The device's clock has drifted, and the code is time-based.	Set the device's date and time to update automatically.
QR code missing or won't scan	New device, or the authenticator app was reinstalled.	Return to the MFA setup screen to generate a new QR code.
Switched phones or reinstalled the app	The old entry no longer works.	Enroll again from the MFA setup screen. Don't reuse the old entry.
Code never arrives by email	The message went to spam, or the address on file is wrong.	Check spam or junk, and confirm the email address on the account.
Several Finalsite sites in one app	Entries look identical.	Label each entry clearly, for example by school name.

Use MFA on a daily basis (subsequent logins)

After enrollment, daily login requires one extra step for authentication.

Enter your username and password or select your IdP login method.
A verification screen immediately prompts for your MFA code.
Select your Method of authentication (Email or Authenticator app).
Input the time-sensitive One-Time Code (OTC) from your chosen method.
The session is authenticated, granting secured access to the platform.

Switch between products seamlessly

Once you are logged in, you can switch products and remain logged in. Your session stays active, so there's no need to re-enter credentials as you navigate between Finalsite products.

Manage your post-login experience

Upon successful login, a user session is created.
User gains access to the platform.
User is seamlessly connected to other Finalsite products which have been configured with SSO.
After 20 minutes of inactivity:
- Session is terminated
- User is redirected to the login page
- Display message confirms termination of session