Identity providers
Platform → Identity providers lets your staff sign in with their work account from Microsoft Entra ID or
Google Workspace instead of a password. Only Platform Administrators see it (installation.settings). Customers
on the portals sign in as before.
- Microsoft Entra ID: one enterprise application for the desk. The desk's roles are app roles of that application, so you pick a role when you assign someone to it, or put a role in an access package. With provisioning (SCIM), people are created when they're assigned and disabled when they're unassigned, without waiting for a sign-in.
- Google Workspace: Sign in with Google for your Workspace domain. Roles are given in the desk.
The desk can have one of each, for different email domains.
How people sign in
With a provider on, the sign-in page asks for the email first. An email in one of the provider's domains goes to the provider; any other email gets the password field, and passkeys work as before.
Back from the provider, the desk finds the person by their account at the provider (Entra's object id, Google's account id), and the first time by their email:
| Who | What happens |
|---|---|
| Someone already in the desk | Linked to their account at the provider, and signed in. From then on, a changed email at the provider follows them. |
| Someone new | Created, if Create people at their first sign-in is on and a seat is left, and placed in the unit you chose. Otherwise refused with the reason. |
| A Platform Administrator | Never through a provider: they sign in with their password or a passkey. |
| Someone who works in another organization of the desk | Refused: a provider acts only in its own organization. |
| A disabled account | Refused. You enable them under Users, or Entra does through provisioning when they're assigned again. |
Someone new counts as a staff user from their first sign-in, like someone invited. When every seat is used, the next new person is refused and the attempt is in the audit log; everyone already in keeps signing in.
A session that began at a provider lasts at most 12 hours. The next sign-in goes back to the provider, which brings roles from Entra ID in line again.
The second factor
The desk asks for its own second factor (authenticator code or passkey) after a provider's sign-in, for people who have one, unless:
- Entra ID asks for a second factor (or Google Workspace asks…) is on: your provider requires it for this app (Conditional Access in Entra, enforced 2-Step Verification in Google), so the desk doesn't ask again; or
- Entra ID says in the sign-in that multifactor authentication was used.
Sign in only through the provider
People in the domains sign in only here stops passwords and passkeys for everyone in the provider's domains: they get "Your organization signs you in with Microsoft Entra ID" and continue with their work email. Password reset emails aren't sent to them either.
Two kinds of people still sign in with a password, so you can get in when the provider can't be reached or is set up wrong:
- Platform Administrators.
- The people you name under Still sign in with a password. The setting can't be turned on without at least one of them who has a password; give them an authenticator app or a passkey too.
Roles from a provider
Roles that Entra ID gives show as from Entra ID on the person in Users. They are taken away in Entra (remove the assignment, or let the access package end), not in the desk: the desk removes them at the person's next sign-in. Roles you give in the desk stay whatever Entra says, and someone with only those still gets in.
Google Workspace gives no roles. Someone new gets the role you chose for them; after that you manage their roles in the desk.
For auditors
Every sign-in through a provider, every refusal with its reason, every person created and every role given or taken away is in the audit log, with the provider. So are changes to a provider's settings (never the secret or key), the certificates the desk made, added and removed, and the roles written to Entra ID.
[!NOTE] Removing a provider takes away the roles it gave. People stay, and the roles given in the desk stay; people in its domains sign in with a password or passkey again (someone who never had a password uses Forgot your password?).