Company sign-in — Help center

Company sign-in (single sign-on) lets your team members sign in with your company's own identity provider, such as Google Workspace, Microsoft Entra ID or Okta, instead of their password. It uses OpenID Connect. This guide explains how to set it up and, just as important, who it does not work for.

Before you start

Company sign-in is available when your plan includes Company sign-in.
Only owners and administrators can see and change the settings.
In your identity provider, create an OpenID Connect web application (sometimes called a client or app registration). You need its issuer address, client ID and client secret.
Every person who will use it must already be a member of your company, invited the usual way, with the same email address they have in the identity provider. Company sign-in never creates accounts or members. See Team.

Set it up

To open it, click Team in the sidebar, then Company sign-in at the top of the page. The button shows for owners and administrators when your plan includes it.

Fill Issuer address: the provider's issuer, starting with https://. The system reads the provider's settings from that address followed by /.well-known/openid-configuration.
Fill Client ID and Client secret. The secret is stored encrypted. When you change other settings later, leave the secret empty to keep the current one.
Copy the address shown under Turn on. Add it to your identity provider as the allowed redirect (callback) address.
Tick Turn on.
Select Save.

In the provider, allow the openid, email and profile scopes, and make sure the provider marks email addresses as verified.

How your team signs in

Give your team the company sign-in address: https://rutbacrm.com/sso/ followed by your company's short name, the first part of your company address. For example, if your company address is https://acme.rutbacrm.com, the sign-in address is https://rutbacrm.com/sso/acme.

Opening it sends the person to your identity provider. After they sign in there, they come back signed in to your company's Home page. The sign-in page itself doesn't show a company sign-in button.

Who can't use it

A person's account isn't owned by one company: the same account can belong to several companies, and may be a platform account. So that one company's identity provider can never open an account it doesn't fully control, company sign-in refuses:

Owners of the company.
People who are also members of another company, even with a suspended membership there.
People who turned on two-step sign-in for their account.
Platform staff accounts.
Anyone who is not a member of your company, or whose email address is not confirmed in their account.

These people keep signing in with their password. The page reminds you: "It works for members of this company only. Owners, people in another company, and people with two-step sign-in keep using their password."

Requirements for the provider

All of the provider's addresses must use https:// on the standard port. They may be on more than one host, as with Google and Microsoft.
The provider must say the email address is verified. A provider that doesn't send this, as Microsoft Entra ID does in some setups, is refused until it is configured to.
The provider must be reachable on the public internet.

Good to know

Company sign-in doesn't replace passwords: anyone can still sign in with their password.
Turning it off (clear Turn on and save) stops the sign-in address at once. It then shows "not found", as it does if your plan no longer includes the feature or your company is suspended.
SAML, creating accounts from the provider, and limiting access to certain records are not available.
It has not yet been tried with every provider. Test it with one member before telling the whole team.

Troubleshooting

"This sign-in could not be completed. Ask your administrator, or use your password." One of the checks failed: the person is in the list above, their email in the provider doesn't match their account, the provider didn't confirm the email is verified, or the issuer address, client ID or secret is wrong.

The provider says the redirect address is not allowed. Copy the address shown on the Company sign-in page exactly into the provider's allowed redirect addresses.

The sign-in address shows "not found". Turn on isn't ticked, or your plan doesn't include Company sign-in.