Per-Brand Authentication Methods

Administrators can now configure each brand within a client tenant with its own dedicated authentication method. Brands can be set up independently with SSO with Pre-registration, username/password, or a combination of both on the same login screen.

Where dual authentication is configured for a brand, the login screen can present either username/password as the primary interface with SSO as a secondary action, or SSO as the default flow with a username/password fallback. A maximum of one SSO provider is supported per brand. User identity is resolved using email address as the canonical identifier, ensuring users who hold credentials under both methods are recognised as a single portal identity.

When both SSO with Pre-registration and username/password are enabled on a brand, the self-service signup screen is removed from the username/password login flow to prevent unauthorised account creation. Users must be created via the FenX Portal User Management area, where they are automatically set to Verified status and no verification email is sent.

User Guide Reference: Portal Brand Configuration — Per-Brand Authentication Methods