Single sign-on

Single sign-on lets your people into Emargen through your company’s own sign-in, such as Okta or Microsoft Entra. They use the account they already use for everything else. Nobody has one more password, and your company’s roles can grant Emargen roles.

Every organisation starts on passwords, kept in Emargen. Single sign-on is for the organisations that ask for it.

Signing in

The sign-in screen asks for an email address first. If the address is at a domain your company has proved, the screen says your organisation signs in with single sign-on. Continue with single sign-on takes the person to your company’s sign-in, with the address filled in. Outside those domains, everyone gets the same password prompt, known or not, so the screen never gives away if an account exists.

People can also start from Emargen’s tile in your company’s portal.

Each organisation has its own sign-in. Someone in two organisations chooses one from a list after signing in. Each row says what it takes to open it: nothing, single sign-on, or a password. They sign in to each once, and then both stay signed in side by side in the same browser. Switch organisation, in the menu under their name, opens the same list. Signing out ends both.

Getting in

Anyone your company’s sign-in lets through, at one of your proved domains, gets in. The first time, they join as a member, with whatever roles their company roles give.

People at other domains, such as contractors, are invited. While passwords still work for your organisation, they sign in with one. Once it’s on single sign-on only, a password sign-in is refused. A contractor then comes in through your company’s sign-in, with an account your company gives them there.

Roles from your company’s sign-in

Your company’s sign-in can pass on people’s company roles, the way your IT team maps them from its groups. You decide which Emargen roles each one gives, under From single sign-on on Roles & permissions. Each company role has a row there, with how many people had it at their last sign-in and the Emargen roles it gives.

Map your support managers’ company role to a Support role that can invite people, say. Every support manager can then bring in support colleagues from their first sign-in, and nobody has to grant it by hand. The built-in Administrator role can be mapped too.

• Roles from sign-in follow your company’s roles. They’re set at every sign-in, and again as the sign-in renews while someone stays signed in. Lose a company role, and the Emargen roles it gave go with it.
• Roles given by hand stay beside them. On a role’s page, the people who hold it from sign-in are marked From sign-in. You can remove only the roles you gave by hand.
• Change the mapping, and everyone’s roles change at once, from the company roles they had at their last sign-in.
• Someone can always manage roles. If the change would leave nobody able to manage roles, that person keeps their sign-in roles as they were. Emargen tells everyone who manages roles in their Inbox.
• You can’t delete a role while a company role still gives it. Take it off the company role first.

Sign-in never takes away a role given by hand. We built it that way so the Administrator role your organisation started with always stays.

Until you map a company role, you give every role by hand in Emargen. You see From single sign-on only while your organisation signs in through your company, or still maps a company role.

Changes for your people

• Name and email. They come from your company’s sign-in and are set again each time someone signs in. Your profile shows them with no way to change them, and says to ask whoever runs your company’s sign-in.
• Passwords. With single sign-on only, nobody signs in to your organisation with a password. The Password section of Security names only the organisations someone signs in to with one.
• Leaving. Someone removed only at your company keeps their access in the browser until their company sign-in session ends, seven days at most. A token they made for an agent works until it expires. You can take the roles you gave them by hand on Members, and revoke their agents on Agent access, at once. Members can’t remove someone from the organisation yet, so to end their access completely, ask Emargen.
• Their own agents. Tokens keep working. Once the organisation is on single sign-on only, someone connecting Claude or ChatGPT signs in through your company first. The screen says to use your company’s sign-in instead.

Switching it on

Emargen switches single sign-on on when you ask. Bring someone from your IT team who runs your company’s sign-in. They prove the domains your people sign in from, and connect your sign-in to Emargen.

Three steps, so nobody is locked out:

1. Passwords only, as every organisation starts.
2. Single sign-on and passwords, to try it. Both work.
3. Single sign-on only, once at least one administrator has signed in through it. Passwords never go off before someone can get in.

Emargen checks your proved domains before each step. If your organisation goes back to passwords, its mappings stay until you take them off, but signing in gives no roles then.

Next

How to

• Invite peoplefor people outside your company’s domains.

Page by page

• Roles & permissionswhere From single sign-on sits.

Guides

• Roles and permissionswhat each role can hold.
• Running Emargen for your organisation