Single sign-on with OIDC and SAML
Enterprise organizations can sign in with their identity provider, verify their domains, and require SSO for everyone on them.
Your identity provider, your sign-in
Connect Okta, Microsoft Entra ID, Google Workspace or any OpenID Connect or SAML 2.0 provider under Settings → Single sign-on. You paste the values we show into your provider and its details into ours; for OpenID Connect the issuer URL is enough to find the rest.
One connection can serve several email domains. A DNS TXT record proves each one is yours, and nobody on a domain can sign in through the connection until it's verified.
Joining on the first sign-in
An invited person who signs in with SSO joins with the role in their invitation, linked to the employee record HR created. You can also let anyone on your verified domains join on their first sign-in, with the role you pick, in your default location and department, and HR gets an email to check each new record. People HR has offboarded are never let back in that way.
Default location and department
Mark a location and a department as the default. New-person forms start on them, and people created by SSO land in them. When someone has no location, and so no leave, a reminder on the dashboard and the employees, locations and departments pages takes you to a filtered list of them.
Require SSO
Once a test sign-in has worked, switch on Require SSO: password and Google sign-in stop for everyone on your verified domains. The owner keeps password sign-in for emergencies, and every use of it is recorded in the activity log.