# Kinetic Cloud Logins **URL:** \ **Category:** Kinetic ERP\ **Tags:** users, cloud, security\ **Created:** [February 5, 2026, 12:48pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539 "2026-02-05T12:48:22Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![aosemwengie1](https://www.epiusers.help/user_avatar/www.epiusers.help/aosemwengie1/32/95533_2.png) [@aosemwengie1](https://www.epiusers.help/u/aosemwengie1)\ **Post date:** [March 24, 2026, 3:44pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/41 "2026-03-24T15:44:34Z")
Yep. ---
**Author:** ![utaylor](https://www.epiusers.help/user_avatar/www.epiusers.help/utaylor/32/64664_2.png) [@utaylor](https://www.epiusers.help/u/utaylor)\ **Post date:** [March 24, 2026, 3:45pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/42 "2026-03-24T15:45:00Z")
> [@FTI-SeniorAdmin](#): > > Not all users who would be entering this have an email address, unfortunately this process will be required by even an assembly user just trying to get a MES instance open. yeah, if you want to use entra, that’s what it will take. ---
**Author:** ![FTI-SeniorAdmin](https://www.epiusers.help/user_avatar/www.epiusers.help/fti-senioradmin/32/94053_2.png) [@FTI-SeniorAdmin](https://www.epiusers.help/u/FTI-SeniorAdmin)\ **Post date:** [March 24, 2026, 3:45pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/43 "2026-03-24T15:45:22Z")
It’s not usable, or at least I can’t turn it on in my current instance… I have one user in that DB and it can’t enable it. I get the above error. ---
**Author:** ![aosemwengie1](https://www.epiusers.help/user_avatar/www.epiusers.help/aosemwengie1/32/95533_2.png) [@aosemwengie1](https://www.epiusers.help/u/aosemwengie1)\ **Post date:** [March 24, 2026, 3:47pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/44 "2026-03-24T15:47:12Z")
The cloud team has to do it. ---
**Author:** ![FTI-SeniorAdmin](https://www.epiusers.help/user_avatar/www.epiusers.help/fti-senioradmin/32/94053_2.png) [@FTI-SeniorAdmin](https://www.epiusers.help/u/FTI-SeniorAdmin)\ **Post date:** [March 24, 2026, 3:47pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/45 "2026-03-24T15:47:25Z")
Trust me, this is not a want, this is a NEED. To stay secure for NIST and CMMC requirements we have CUI information in our Epicor DB so we are required by those standards to secure that data with MFA. I’m only going the route of Entra to “Simplify” this and keep the MFA under one umbrella and sync’d user passwords. But it’s becoming more complicated every turn I take. > [@utaylor](#): > > Makes sense, I wasn’t sure if that conditional access policy required a certain license in office 365 whereas a yubikey is just the cost of a key. That means you don’t enforce MFA on that azure account you made? The MES account would also not have access to any trackers so in essence it can’t access any CUI so I shouldn’t need MFA on that account only. I have been successful in creating only a domain user ID, that syncing with Entra and it having NO licenses applied to it and I can still assign it to the conditional access policy and it works when you attempt to login to that account at an office login portal. I can login in house, but not outside this IP. ---
**Author:** ![aosemwengie1](https://www.epiusers.help/user_avatar/www.epiusers.help/aosemwengie1/32/95533_2.png) [@aosemwengie1](https://www.epiusers.help/u/aosemwengie1)\ **Post date:** [March 24, 2026, 3:51pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/46 "2026-03-24T15:51:46Z")
You can still maintain accounts that use basic auth. Just don’t check the SSO required checkbox in user account maintenance. ---
**Author:** ![chaddb](https://www.epiusers.help/user_avatar/www.epiusers.help/chaddb/32/89855_2.png) [@chaddb](https://www.epiusers.help/u/chaddb)\ **Post date:** [March 24, 2026, 3:52pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/47 "2026-03-24T15:52:10Z")
> [@utaylor](#): > > I wasn’t sure if that conditional access policy required a certain license in office 365 Conditional access requires a Microsoft Entra ID P1 or Business Premium license. For every user that will use conditional access. Microsoft Entra ID P1 is Azure Active Directory P1 rebranded. It’s included in M365 E3. ---
**Author:** ![FTI-SeniorAdmin](https://www.epiusers.help/user_avatar/www.epiusers.help/fti-senioradmin/32/94053_2.png) [@FTI-SeniorAdmin](https://www.epiusers.help/u/FTI-SeniorAdmin)\ **Post date:** [March 24, 2026, 3:54pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/48 "2026-03-24T15:54:13Z")
> [@chaddb](#): > > Conditional access requires a Microsoft Entra ID P1 license. For every user that will use conditional access. And there is the next issue… For something that should be simple for Microsoft to restrict, they allow you to assign any user to conditional access even if they do not have a license. Never mind that I was forced into using conditional access when they retired their Exchange level administration of MFA ---
**Author:** ![chaddb](https://www.epiusers.help/user_avatar/www.epiusers.help/chaddb/32/89855_2.png) [@chaddb](https://www.epiusers.help/u/chaddb)\ **Post date:** [March 24, 2026, 3:55pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/49 "2026-03-24T15:55:59Z")
> [@FTI-SeniorAdmin](#): > > For something that should be simple for Microsoft to restrict, they allow you to assign any user to conditional access even if they do not have a license. Yeah, it gets rather confusing and messy. Microsoft has a licensing mess with all the Entra/365 products. And the constant renaming and bundling makes it even worse. You’re technically violating the terms if you use it without the proper license for each user. Will Microsoft notice and stop you? Probably not if you’re a small company. Not worth their time. But Microsoft could come back and ask for payment for all those users that used it without a proper license. And add on who knows what kind of penalties hidden in the terms no one reads. Everyone can do what they want but just know the risks. ---
**Author:** ![FTI-SeniorAdmin](https://www.epiusers.help/user_avatar/www.epiusers.help/fti-senioradmin/32/94053_2.png) [@FTI-SeniorAdmin](https://www.epiusers.help/u/FTI-SeniorAdmin)\ **Post date:** [March 24, 2026, 5:13pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/50 "2026-03-24T17:13:56Z")
> [@aosemwengie1](#): > > You can still maintain accounts that use basic auth. Just don’t check the SSO required checkbox in user account maintenance. you thought… Response from my Epicor ticket.. _Jon Q1: Due to security requirements, we will not be allowed to have Basic login available to Entry users, Every user who has access to Part or Job Tracker will need to login with a service supporting MFA. How is that prevented from being accessed if it’s a drop down option during the login prompt?_ _A: The Basic Authentication drop down choice is hard coded in the application._ _Jon Q2: Is there a way to prevent a user ID from utilizing Basic Authentication? I’ve been told maybe by using the SSO check box in the user account setup, is that true?_ _A2: Yes, your understanding is correct when accessing Kinetic from the client but not when accessing Kinetic from the browser._ If I read that correctly, that means there is no way to enforce MFA for an Epicor user utilizing the Browser, which is standard product come May 2026, since Basic Authentication is always allowed being “Baked into the application” Are they telling me BS or is this true? ---
**Author:** ![utaylor](https://www.epiusers.help/user_avatar/www.epiusers.help/utaylor/32/64664_2.png) [@utaylor](https://www.epiusers.help/u/utaylor)\ **Post date:** [March 24, 2026, 5:15pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/51 "2026-03-24T17:15:17Z")
Try it out for yourself. I’m fairly certain from browser, when I have the SSO only box checked you cannot use basic authentication, it won’t let you… the drop down will still be there and allow you to select it, but you can’t use it. ---
**Author:** ![FTI-SeniorAdmin](https://www.epiusers.help/user_avatar/www.epiusers.help/fti-senioradmin/32/94053_2.png) [@FTI-SeniorAdmin](https://www.epiusers.help/u/FTI-SeniorAdmin)\ **Post date:** [March 24, 2026, 5:23pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/52 "2026-03-24T17:23:49Z")
Ok, confirmed… this is a false statement by support. 😒 I enabled SSO on the Manager account and it doesn’t allow me to use Basic, I get an error stating that the User ID is required to use single sign-on. One bullet dodged… I was also told because I am required to use Gov Cloud for our CUI data that we have less login options available to us. However they said this. _Jon Q1: I was hoping to get more information regarding login options for the scenarios above, yet the consulting that I received pushed me down this path which seems like the login process is more complicated and requires users to remember/enter more information that is not relevant to them at all. I was hoping for a solution that would just direct the user to a Microsoft login page and authenticate them with those known credentials/MFA or Password-less FIDO2 token_ _A1: The following services are only available to Public Cloud customers._ _Azure Authentication_ _Epicor Identity Provider_ _Jon Q2: Is Azure Authentication not what I just had enabled on my Live environment? And Basically this is saying because my data is required to be on Gov Cloud storage we have less login options available to us?_ _A2: Yes, correct._ 🤨 I don’t know what to believe from support right now… Nothing they are saying makes sense. ---
**Author:** ![utaylor](https://www.epiusers.help/user_avatar/www.epiusers.help/utaylor/32/64664_2.png) [@utaylor](https://www.epiusers.help/u/utaylor)\ **Post date:** [March 24, 2026, 5:26pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/53 "2026-03-24T17:26:42Z")
It is tough when you get things from support that don’t reflect how the product actually works. Glad you were able to test it and found that it worked. ---
**Author:** ![jbooker](https://www.epiusers.help/user_avatar/www.epiusers.help/jbooker/32/83580_2.png) [@jbooker](https://www.epiusers.help/u/jbooker)\ **Post date:** [March 26, 2026, 12:11am UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/54 "2026-03-26T00:11:33Z")
Has anyone tried Intune kiosk configuration on an AAD joined device with MES url as an auto-startup Edge app? ---
**Author:** ![FTI-SeniorAdmin](https://www.epiusers.help/user_avatar/www.epiusers.help/fti-senioradmin/32/94053_2.png) [@FTI-SeniorAdmin](https://www.epiusers.help/u/FTI-SeniorAdmin)\ **Post date:** [March 26, 2026, 6:13pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/55 "2026-03-26T18:13:27Z")
> [@utaylor](#): > > It is tough when you get things from support that don’t reflect how the product actually works. Glad you were able to test it and found that it worked. Man the doubled down on the statement that you can’t enforce SSO on a user and they could at anytime use Basic… I’m so glad they are wrong with this because that would be a huge security risk. ![image](https://www.epiusers.help/uploads/default/original/3X/9/8/98f8153683433f7f09806706d50f7c7a7a4beac3.png) ---
**Author:** ![markdamen](https://www.epiusers.help/user_avatar/www.epiusers.help/markdamen/32/54917_2.png) [@markdamen](https://www.epiusers.help/u/markdamen)\ **Post date:** [March 27, 2026, 9:07am UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/56 "2026-03-27T09:07:32Z")
@FTI-SeniorAdmin there is another option you could check out. Epicor Identity allows you to configure Azure AD (Entra) as an External Provider for authentication. You setup an App Registration in Azure, then provide that ID to Epicor Identity in the admin portal. You can either allow users to self enroll, or you can pre-provision that by creating the mapping. When you go to the Kinetic application you would choose Epicor Identity Provider, then input email address, but on the next page instead of inputting password for Epicor IdP you simply click the Azure AD button at the bottom. This trigger the Microsoft login process and would follow Conditional Access, MFA settings etc. You can try all that non-destructively. Once you’re happy it’s working, you could then enforce that all Epicor IdP logins must be via External Provider: ![image](https://www.epiusers.help/uploads/default/original/3X/9/6/9688e4f131e0ef4feb014abccd0f597c693574f6.png) That way you’re achieving the aim that all logins are controlled via Entra ID. ---
**Author:** ![FTI-SeniorAdmin](https://www.epiusers.help/user_avatar/www.epiusers.help/fti-senioradmin/32/94053_2.png) [@FTI-SeniorAdmin](https://www.epiusers.help/u/FTI-SeniorAdmin)\ **Post date:** [March 27, 2026, 11:15am UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/57 "2026-03-27T11:15:57Z")
@markdamen Thankfully I don’t feel that pathway is necessary since the “Require SSO” check box does what it should for the web based environment. The thing that is bothering me is the fact that they continue to say that does not enforce it and the user can still use basic even with that checked off which is an outright false statement, Utah can attest to that as well as I’ve tested it multiple times and it will not allow me to use Basic when that is enabled. When I spoke to Ian (consultant) about the login options, he did mention the use of Epicor Identity and then linking that to azure, but he even said its cumbersome and feels like you’re double logging in, and that enabling Azure integration directly in Kinetic is a better more seamless login process. The only thing that bothers me about it is the requirement to enter the Tenant ID before you even see the login prompt. They should be able to make an ID default so the user never sees that, or has to know it to enter it. ---
**Author:** ![jbooker](https://www.epiusers.help/user_avatar/www.epiusers.help/jbooker/32/83580_2.png) [@jbooker](https://www.epiusers.help/u/jbooker)\ **Post date:** [March 27, 2026, 11:33am UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/58 "2026-03-27T11:33:46Z")
> [@FTI-SeniorAdmin](#): > > The only thing that bothers me about it is the requirement to enter the Tenant ID before you even see the login prompt. Curious, what this is all about. You cannot simply navigate to your ERP home page and login via M365? We use Epicor Identity + Entra and it’s great. There’s a setting to avoid the extra button click such that you enter your email and it launches M365 flow directly (or not at all if your browser already has a valid token). Could see it seeming like an extra step if you’re coming from Windows Integrated on-prem. Without windows integrated, I don’t see the IdP drawbacks. Further Idp, is setup once and then works for all Epicor stuff, EpicWeb, Epicare, Learning Center, ECM, etc On the other hand, if windows integrated SSO works with AAD-joined devices we’d drop IdP. Has anyone tried? ---
**Author:** ![FTI-SeniorAdmin](https://www.epiusers.help/user_avatar/www.epiusers.help/fti-senioradmin/32/94053_2.png) [@FTI-SeniorAdmin](https://www.epiusers.help/u/FTI-SeniorAdmin)\ **Post date:** [March 27, 2026, 11:44am UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/59 "2026-03-27T11:44:17Z")
> [@jbooker](#): > > Curious, what this is all about. You cannot simply navigate to your ERP home page and login via M365? So first time experience and I’m assuming on a browser setup to dump cache or cookies after closing you will see this screen first. ![image](https://www.epiusers.help/uploads/default/original/3X/1/6/16613523fee77d80a58799f7a0d29d3e95e8332a.jpeg) Enter the ID, then I get this screen. Dropdown of Azure AD or Basic. ![image](https://www.epiusers.help/uploads/default/original/3X/5/1/516fbb737246372ed3fa72c612dff60746433f0a.png) Click Login with Azure selected and then you see the Microsoft O365 login experience. I have also found that on a machine using Microsoft Edge where a users has O365 activated and is also linked to an Epicor user, it will just automatically login after you click that Log in button. So that’s a big plus for our office users, and may make this much easier. I still need to do some testing on our plant floor MES stations since that Kinetic user will not have access to any sensitive data so that user will be logging in with basic, as well as the domain user logging into the PC’s will not be linked to O365 or Kinetic. So I need to test those steps to see how our assembly personnel will have to log in a PC every morning. > [@jbooker](#): > > Further Idp, is setup once and then works for all Epicor stuff, EpicWeb, Epicare, Learning Center, ECM, etc I could agree with this if our staff had any use for EpicWeb, or Epicare. I am the only one who deals with any of that, everyone else doesn’t understand it, or they are too afraid of it and they don’t want to learn it. When we start testing I can guarantee I will have staff that will struggle with Kinetic web and how it can open modules in separate browser tabs, or how it will just browse to that module in the existing tab. I’m struggling right now to get our SME’s to attend and use learning paths and courses on the learning center. It is going to be their responsibility to pick and push out training to their employees directly below them and I can guarantee that will not happen smoothly and I’ll most likely be pulled into the process of selecting what courses they need to assign to their people even though I don’t know how they do their jobs. ---
**Author:** ![markdamen](https://www.epiusers.help/user_avatar/www.epiusers.help/markdamen/32/54917_2.png) [@markdamen](https://www.epiusers.help/u/markdamen)\ **Post date:** [March 27, 2026, 12:03pm UTC](https://www.epiusers.help/t/kinetic-cloud-logins/132539/60 "2026-03-27T12:03:05Z")
In summary the method I outline I like for these reasons: - No support ticket required to enable - IdP enabled out of the box for Cloud - No need for users to know/remember Tenant ID - Seamless login to ELC etc are outlined by Josh You’re in control of it all - and still taking the benefit of MFA, Conditional Access etc. [Previous page](https://www.epiusers.help/t/kinetic-cloud-logins/132539.md?page=2) [Next page](https://www.epiusers.help/t/kinetic-cloud-logins/132539.md?page=4)