Skip to content
EntryWick documentation

For an owner or admin whose organization already signs in with Microsoft 365 or Google Workspace.

Single sign-on

Settings → Single sign-on, the sign-in page, and registration forms that ask for it. Scale plan. Spec: docs/INTEGRATIONS.md §3 v3 (Microsoft Entra / Google Workspace), docs/PRICING_ENTITLEMENTS.md §7 (sso).

Who opens it: an owner or admin whose organization already signs in with Microsoft 365 or Google Workspace. What they came to do: let the team sign in with their work account instead of one more password, and let employees register for a company event without typing (or mistyping) their work address. What must be true when they leave: a person from their directory can sign in and lands where their role starts; nobody outside the email domains they listed can; nobody is ever made an Owner this way.

Setting it up

Each organization uses its own app, created in its own console, so it decides what the app may read and can revoke it there at any time. The client secret is stored encrypted and never shown again.

Microsoft Entra ID (Azure portal → Microsoft Entra ID → App registrations → New registration)

  1. Supported account types: Accounts in this organizational directory only.
  2. Redirect URI: platform Web, the address Settings → Single sign-on shows (it ends /sso/entra/callback).
  3. Certificates & secrets → New client secret; copy the value.
  4. On Settings → Single sign-on paste the Application (client) ID, the secret, and the Directory (tenant) ID from the app's overview.

Google Workspace (console.cloud.google.com → APIs & Services)

  1. OAuth consent screen: user type Internal.
  2. Credentials → Create OAuth client ID → Web application; authorized redirect URI: the address the page shows (it ends /sso/google_workspace/callback).
  3. Paste the client ID, the secret and your Workspace domain (example.org).

Then, for either:

  • Email domains that may sign in — every address must be at one of these (example.org, example.co.uk). Required.
  • Add people from these domains the first time they sign in — on: a colleague who is not yet on the team is added with the role you choose. Off: only people already on the team (or invited) can sign in this way.
  • Role for people added this way — any role but Owner, and no role limited to one group (Group Lead, Check-in Staff, or a custom role set to one group): nobody is there to choose the group. Viewer is a safe start; change a person's role on Team afterwards.

Turn off removes the secret. Team members then sign in with a password; somebody who only ever used single sign-on has none yet and uses Forgot password.

Signing in

The sign-in page shows Sign in with Microsoft or Sign in with Google above the password form. After the work account's own sign-in:

  • An address that already has an EntryWick account uses that account — nobody gets a second one. A pending invitation is accepted, with the role it was sent with.
  • A newcomer is added with the default role, if adding is on and a seat is free on the plan.
  • Two-factor codes are still asked for anyone who set them up.
  • Somebody whose access was switched off on Team is refused.
  • Everyone lands on their role's home page, as after a password.

Refused: an account from another Microsoft directory or another Google Workspace (even with the right app), a personal Gmail account, an unverified Google address, an address outside the listed domains. The sign-in page says why.

Registration forms that ask for it

A registration form whose settings say "auth": "sso_required" — the Corporate Offsite event template's Employee registration (SSO) — shows only the sign-in buttons until the registrant has signed in. Afterwards the form opens with their work address filled in and read-only, and that address is the one registered, whatever the browser sends. Registrants are not added to the team and are not signed in to anything; the verified address is remembered in their browser for an hour.

In an embedded form the buttons open the full registration page, because Microsoft and Google do not show their sign-in inside a frame on another website. If no sign-in is connected (or the plan no longer includes it) the form says it is not available right now — it never opens without the sign-in.

When the plan changes

Below Scale the page is hidden, and a connection is paused, not deleted: the buttons disappear and a sign-in already under way is refused. Password sign-in keeps working for everyone. Back on Scale, paused connections come back as they were.