What it does
People sign in with the work account they already use. Disable someone at Google or Microsoft and their next sign-in fails. Signing in only confirms who someone is: what they can see still comes from their role and teams, and an owner still decides who is a member.
- ChooseOn the sign-in page, press Continue with Google or Continue with Microsoft.
- ConfirmGoogle or Microsoft confirms your work account and sends you back.
- DoneYou land where you were going, signed in. The emailed code still works too.
Which accounts are accepted
- Google: accounts whose email address Google has verified.
- Microsoft: work and school accounts only, and only when your organisation has verified the email’s domain with Microsoft. Personal Microsoft accounts use the emailed code instead.
Switching it on (administrators, once, free)
| Provider | Where to register | Redirect address |
|---|---|---|
| Google Cloud console, APIs & Services, Credentials, OAuth client ID (Web application). Scopes: openid, email, profile. | https://YOUR-DEPLOYMENT/access/auth/sso/google/callback | |
| Microsoft | Microsoft Entra admin centre, App registrations, New registration, accounts in any organizational directory. Add a client secret, and in Token configuration add the optional ID-token claim xms_edov. | https://YOUR-DEPLOYMENT/access/auth/sso/microsoft/callback |
Then set RK_SSO_GOOGLE_CLIENT_ID and RK_SSO_GOOGLE_CLIENT_SECRET (or the MICROSOFT pair) on the deployment. The buttons appear on the sign-in page by themselves. We do this with you during setup.
Tip
Okta, OneLogin and other SAML providers, and automatic account sync, are available on request.