AMS360 single sign-on (SSO): how agencies set it up

By Tyler Mayberry · Cirlet. Published 2026-10-28. Page updated 2026-11-11.

Based on Vertafore’s public AMS360 and VSSO help, checked November 11, 2026. Vertafore changes its settings and screens, so confirm with your VSSO administrator or Vertafore before changing anything on your account. Cirlet isn’t affiliated with Vertafore.

AMS360 single sign-on is Vertafore Single Sign-On (VSSO). It gives each AMS360 Online user one email address and password for every Vertafore product they’re set up for. An agency administrator enrolls the agency in the VSSO console, activates each person’s existing AMS360 login, and can require multi-factor authentication for everyone with one checkbox.

That’s fewer passwords for your staff to keep track of. It also means one sign-in now opens your client records in AMS360 and every other Vertafore product the person uses. Protect that account like you’d protect the agency management system itself.

Just trying to sign in?

If your agency already uses VSSO, open AMS360, look for “Sign In with Vertafore Single Sign-On” and enter your VSSO email address and password. If you see “Sign In or Create Account” and you’ve set up VSSO before, choose Sign In. Choosing Create Account again makes a duplicate account. Not sure whether you’re set up? Ask whoever manages Vertafore access at your agency, or read Vertafore’s instructions for existing users.

What Vertafore supports

Who can use it	“VSSO is for AMS360 Online agencies only,” according to Vertafore’s AMS360 help. Vertafore lists AMS360 Online 7.5 or later as supported, along with products such as PL Rating, ReferenceConnect, TransactNOW, WorkSmart Online and AMS360 Mobile.
Where it’s managed	In the VSSO console at `vim.identity.vertafore.com/VIM`. Vertafore says you can also open it from AMS360 under 360 Toolbox › Vertafore Single Sign-On.
How people sign in	With an email address and a password. Vertafore says the email address is the user name, and VSSO also uses it to verify the person, send setup instructions and reset passwords.
MFA	Multi-factor authentication is off by default. An administrator turns it on for the whole agency with a checkbox on the console’s My Organization tab. Each user then registers a second factor: the PingID phone app, a voice call or a code sent by email. Vertafore recommends the PingID app.
Roles	Administrator (every user, product and setting), Group Administrator (users and products in selected groups) and User (their own name, password and security questions).
Passwords and lockout	Passwords expire every 90 days (release notes, August 2026 entry). Three wrong passwords in a row lock the account for 15 minutes. A forgotten password is reset through an emailed link that lasts 12 hours.
Access records	A Product Access Report on the My Organization tab downloads a locked Excel file showing each user’s groups and the products they can open.
Entra ID, Okta and other identity providers	Vertafore’s public VSSO help doesn’t describe connecting VSSO to Microsoft Entra ID, Okta or any other identity provider through SAML or OpenID Connect. We checked all 49 help topics on November 11, 2026. If you want staff to sign in with their Microsoft 365 accounts, ask Vertafore whether that’s available for your agency before you plan around it.

Who does what at the agency

Owner or office manager: decides MFA is required, names at least two VSSO administrators and owns the checklist for when someone leaves.
VSSO administrator (often the office manager or AMS360 system administrator): enrolls the agency, connects products, activates users, sets roles and removes access.
Each staff member: finishes activation, registers a second factor and chooses Sign In, not Create Account, from then on.
Your IT provider: secures the mailboxes VSSO sends resets to, keeps computers and browsers updated, and allows Vertafore’s sign-in page if your network filters websites.
Vertafore Support: anything inside VSSO or AMS360 your administrator can’t fix.

Setup checklist

Vertafore splits setup into steps before, during and after enrollment. Here’s the short version for an agency already on AMS360 Online.

Make sure everyone has a working email address of their own. VSSO uses it as their user name and for password resets.
Have the AMS360 administrator user ID, password and email address ready. Vertafore says the AMS360 administrator email is the one it sends upgrade notices to.
Self-enroll the agency. VSSO checks your AMS360 (or PL Rating) administrator details, connects that product and creates your first VSSO administrator account.
Give a second person full administrator rights. Vertafore says you should have at least two. Administrators can’t change their own email address or reset their own password in the console, so the second one is your way back in.
Activate existing users from Manage Products › VSSO Status. Don’t create new VSSO accounts for people who already have an AMS360 login. Vertafore warns that makes duplicates with no link to their existing information. With a lot of users, Vertafore suggests activating a few at a time.
Send people Vertafore’s activation instructions and tell them to always choose Sign In after the first time.
Turn on MFA on the My Organization tab, then check that each person has registered a second factor.
Download the Product Access Report and keep it with your access records.

Common login problems and what to check

Can’t sign in early, late or on weekends	New AMS360 users created through VSSO can only sign in from 8 AM to 5 PM, Monday to Friday, by default. An AMS360 administrator changes the login hours on the employee record.
Locked out after a few tries	VSSO locks the account for 15 minutes after three wrong passwords. Wait it out, then use “Forgot my password.” Without VSSO, AMS360 itself locks a user ID for 20 minutes after five failed attempts.
The reset or welcome email never came	Password reset links last 12 hours and new-user emails last two hours. Check that the address on the account is right and look in junk mail, then ask for a new one. If agency mail isn’t arriving at all, that’s for your IT provider.
Account disabled after time away	VSSO disables accounts that go unused for a while. Vertafore’s help gives 60 days in one place and 90 in another. A full administrator re-enables the account and sends a password reset, and the person should sign in within 24 hours.
Shared computer, wrong person or old login screen	Each person needs to clear browser cookies before the next one signs in. Clearing cookies takes you back to the product’s original login page. Click “Sign in with Vertafore Single Sign-On” from there.
Keeps asking me to sign in	VSSO asks again every 10 hours, or whenever you close and reopen the browser, whichever comes first.
In the right group but a product won’t open	Group membership doesn’t grant product access. The administrator adds the product on that user’s Product Access tab.
The sign-in page won’t load	If your network filters websites, Vertafore says you may need to allow `login.apps.vertafore.com`. Your IT provider handles that.

How SSO and MFA reduce account-takeover risk

With a separate login for every product, people reuse passwords or write them down. With VSSO there’s one password to make strong and protect. The flip side is that one stolen password opens every Vertafore product that person can reach.

That’s why MFA matters most here. With it on, a stolen password isn’t enough. Someone would also need the person’s phone or the code sent to them. Vertafore’s VSSO help says a device stays trusted for 12 hours after an MFA sign-in, and a new device always has to go through MFA.

Two things weaken it. First, VSSO password resets go to the person’s email. If someone gets into that mailbox, they can reset the password, and an emailed MFA code would land in the same inbox. So prefer the PingID app or a voice call over email codes, and make sure every agency mailbox has MFA too (mailbox questions for your provider). Second, MFA stays off until an administrator turns it on. Check that it’s actually on.

MFA won’t stop someone from approving a prompt they were talked into. If you get an MFA prompt you didn’t start, deny it and tell your administrator.

When someone leaves

Disable or delete their VSSO account the day they leave. Only full administrators can do this. Disabling (clear “Enable this user to sign in using Vertafore Single Sign-On” under User Details) blocks sign-in and keeps everything, and you can turn it back on later. It doesn’t free up their AMS360 license. To delete instead, remove every product from their Product Access tab first.
Know what deleting doesn’t do. It doesn’t remove their activity in AMS360 or other products, and removing AMS360 access in VSSO doesn’t delete their AMS360 employee record. To take them out of a product completely, an administrator does that inside the product.
Ask your IT provider to lock or reassign their mailbox, since VSSO resets go to email.
If they were a VSSO administrator, have another full administrator remove their role.
Download the Product Access Report afterward and confirm they’re gone from every product.

If they come back later, Vertafore says to add a user ID and password to their existing AMS360 employee record and then activate VSSO for it. Adding AMS360 to them as a new product can create a duplicate employee.

Vertafore Support or your IT provider?

Your VSSO administrator first for password resets, disabled accounts, login hours and product access.
Vertafore Support (open a case on My Vertafore) when nobody can sign in to AMS360 as the administrator or to the VSSO console, when self-enrollment won’t accept correct administrator details, or when a product won’t connect to VSSO.
Your IT provider when reset or welcome emails aren’t arriving, the sign-in page is blocked, a mailbox might be compromised, or the problem is a computer, browser or password manager.

AMS360 SSO questions

What is AMS360 SSO?

It’s Vertafore Single Sign-On (VSSO). Each user signs in to AMS360 Online and their other Vertafore products with one email address and password, managed by the agency’s VSSO administrators in the VSSO console.

How do we set up single sign-on for AMS360?

An agency administrator self-enrolls the agency using the AMS360 administrator details, gives a second person administrator rights, activates existing users from Manage Products › VSSO Status, and sends each user activation instructions. Vertafore says not to create new VSSO accounts for people who already have an AMS360 login.

Does AMS360 single sign-on support multi-factor authentication?

Yes. It’s off by default. An administrator turns it on for the agency on the VSSO console’s My Organization tab, and users register the PingID app, a voice call or an emailed code as their second factor.

Can AMS360 single sign-on use Microsoft Entra ID or Okta?

Vertafore’s public VSSO help doesn’t describe connecting to Microsoft Entra ID, Okta or another identity provider (checked November 11, 2026). Ask Vertafore whether it’s available for your agency.

Is VSSO available for AMS360 installed on our own server?

Vertafore’s AMS360 help says VSSO is for AMS360 Online agencies only.

Can I still use my old AMS360 login after switching to VSSO?

Vertafore’s VSSO FAQ says AMS360, PL Rating and ReferenceConnect still accept the original login. To get back to that login screen in a browser, clear cookies and close and reopen the browser.

Why does AMS360 keep asking me to sign in again?

VSSO asks you to sign in once every 10 hours, or every time you close and reopen your browser, whichever comes first.

How do we remove a former employee’s AMS360 SSO access?

A full VSSO administrator disables the account (it can be turned back on) or deletes it after removing every product from it. Neither deletes the person’s activity or employee record inside AMS360.

Sources

VSSO help topics show a last update of August 18, 2026. All sources were opened on November 11, 2026.

Rehearse losing access · Prepare for email compromise · All software pages