How do I set up single sign-on (SSO) with Microsoft Entra ID or Google Workspace?

You set up single sign-on (SSO) in Workspace settings, on the Security tab, by connecting Microsoft Entra ID or Google Workspace. Afterwards people from your directory sign in with Continue with Microsoft or Continue with Google and get a Worktivity account on their first sign-in, as long as seats are free. Single sign-on is part of the Pro plan and works during the free trial; Starter and Growth do not include it. Owners and co-owners can set it up, and a Microsoft setup needs one approval from a Microsoft Entra administrator.

Who can set it up, and on which plans?

Owners and co-owners can open the Single sign-on card. It is part of the Pro plan and is included in the free trial. On Starter and Growth the card shows "Single sign-on is part of the Pro plan" and a See plans button. If an organization later moves to a plan without it, the connection is kept but paused: new people are not added, Require SSO is not enforced and nothing is synced. It resumes when the organization is back on Pro.

Before you start, have these ready:

• Microsoft: a work or school Microsoft Entra tenant, and an administrator of that tenant who can approve Worktivity once (a Global Administrator or Privileged Role Administrator).
• Google: a Google Workspace domain. A personal Gmail account shows "This Google account is not part of a Google Workspace domain. Use a work account to connect." and cannot be connected.
• A work email domain that belongs to your organization, for example yourcompany.com. Free email domains such as gmail.com and outlook.com are never accepted, and only people whose email address is on that domain are added automatically.
• Enough free seats. Single sign-on never adds seats and never changes your bill.

Personal sign-in is separate: on any plan, a person can link their own Microsoft or Google account under Account settings > Sign-in methods. The rest of this article is about the organization setup.

Which apps support single sign-on?

Single sign-on sign-in needs these versions or newer. An app that is not on the list has no single sign-on sign-in.

• Web app: Continue with Microsoft and Continue with Google on the sign-in page.
• Worktivity desktop app (Windows and Mac, downloaded from the Worktivity website): version 2.6.3 or later.
• Mac App Store app: version 3.2.0 or later.
• Microsoft Store app: version 1.2.0 or later.
• Chrome extension: version 1.2.0 or later.
• Linux app and mobile apps: no single sign-on sign-in. In an organization that requires single sign-on, people who are already signed in keep working, but they cannot sign in again with a password (only the owner can).

How do I connect Microsoft Entra ID?

1. Sign in to Worktivity as an owner or co-owner, open Workspace settings and choose the Security tab.
2. In the Single sign-on card, choose Connect Microsoft Entra.
3. Sign in with a work account from the tenant you want to connect. The domain of that account's email address must be verified in the tenant.
4. Back in Worktivity, the card shows your directory, Connected and the date.

One Entra tenant can be connected to one Worktivity organization. If you see "This directory is already connected to another organization.", contact support. If you see "We could not verify that your organization owns your work email domain in this directory. Ask your directory admin to verify the domain and try again.", ask your Entra administrator to verify the domain under Custom domain names in the Microsoft Entra admin center, then connect again.

Why does my Entra administrator have to approve Worktivity?

Microsoft requires an administrator of your tenant to approve an app once before it may read the directory. Worktivity uses that approval to check, about every 15 minutes, whether people are still active and still assigned to the app. The permissions are read-only and Worktivity never changes your directory. Microsoft's approval page may show the app without a verified publisher; that is expected.

1. In the card, under Your Entra admin must approve Worktivity once, choose Grant admin consent.
2. A Microsoft page opens. A Global Administrator or Privileged Role Administrator of your tenant approves it. The page lists the read-only permissions User.Read.All, Application.Read.All and GroupMember.Read.All.
3. You return to Worktivity and see "Admin consent granted." The badge changes from Pending admin consent to Active.

Until the approval is given, Microsoft sign-in does not create accounts and Require SSO cannot be turned on. A new person who signs in with Microsoft sees "Your organization has not finished connecting Microsoft sign-in. Ask your admin." and your owners are not notified, so check the badge before you announce the rollout. If the approval is later withdrawn, the card says "Admin consent was withdrawn": automatic deactivation stops, and the desktop app sessions of people who leave stay valid until you block them under Employees. Choose Grant admin consent again to resume. Google needs no approval step.

How do I make sure only assigned people can get in?

Turn on Assignment required for the Worktivity app in Microsoft Entra. Without it, any person or guest account in your tenant that reaches the Worktivity sign-in could be matched to a Worktivity account.

1. In the Microsoft Entra admin center, open Enterprise applications and then the Worktivity application.
2. Open Properties, set Assignment required? to Yes and save.
3. Open Users and groups and add the people or groups who should use Worktivity.

Worktivity checks this list every 15 minutes. Someone who loses the assignment, is disabled or is deleted is blocked in Worktivity, which frees their seat. The card shows "Automatic deactivation: on", the time of the last check and its result. If Entra returns an empty or incomplete assignment list, Worktivity skips the assignment check in that run instead of blocking everyone, and the card says "The assignment check was skipped in the last run."

What happens the first time someone signs in?

The person chooses Continue with Microsoft on the sign-in page. Worktivity matches them to an existing employee with the same email address, or creates a new employee with the role Employee and no password, in the Team for new people. A person with a pending invitation takes over that invitation and does not use a second seat.

Choose the team for new people before the rollout. Create a separate team such as "Unassigned", select it under Team for new people and you see "Team for new people saved." If none is set, Worktivity uses your oldest team. This setting applies to Microsoft Entra and Google Workspace.

Owners and co-owners are not linked automatically. They sign in with their password once and connect their account under Account settings > Sign-in methods > Connect.

How do I require single sign-on?

1. With Microsoft, make sure admin consent is granted. In the card, turn on Require SSO.
2. A dialog asks "Require single sign-on?" Choose Require SSO to confirm.

From then on, everyone except the workspace owner must use single sign-on when they sign in. Employees and co-owners can no longer sign in with a password and see "Your organization requires signing in with single sign-on." Before you turn it on:

• The owner can still sign in with a password. That is your emergency access if your directory is unavailable. Co-owners are not an exception. Every co-owner must connect Microsoft or Google under Account settings > Sign-in methods > Connect before you turn it on; otherwise they cannot sign in until you turn it off. Sign in once with Microsoft or Google yourself to check that it works. The card warns you if your own account has no single sign-on sign-in.
• People on an app without single sign-on sign-in keep working while they are signed in, but cannot sign in to it again: the Linux app, the mobile apps and any app older than the versions listed above. Check which apps your team uses first.
• A person who belongs to several organizations cannot reach an organization that requires single sign-on with a password. The password sign-in picks an organization that does not require it.
• Web sessions in an organization that requires single sign-on last 7 days. Then the person signs in again, usually with one click.
• People who are already signed in stay signed in; the rule applies the next time they sign in. To end someone's session now, block them under Employees.

To go back, turn Require SSO off, or choose Disconnect, which also switches it off. Employees are not deleted. People who were created automatically have no password, so they use Forgot password? on the sign-in page.

How do I manage roles and teams from Microsoft Entra?

On the Pro plan or the free trial, with a Microsoft connection and admin consent, Microsoft Entra can decide who is a Co-owner, Manager or Employee and which team people are in. The workspace Owner is never changed. This works with Microsoft Entra only, not with Google Workspace.

Give roles in Entra

1. In the Microsoft Entra admin center, open Enterprise applications > Worktivity > Users and groups and choose Add user/group.
2. Pick a person or a group and assign the role Worktivity.CoOwner, Worktivity.Manager or Worktivity.Employee.
3. Giving a role to a person does not need Entra ID P1. Giving a role to a group does.

If a person has several roles, the highest one applies (Co-owner, then Manager, then Employee). A person without an assigned role becomes Employee.

Map teams to Entra groups

1. Under Managed from Microsoft Entra, choose Edit team mappings. The Team mappings table opens.
2. Choose Add mapping, then select a Worktivity team (Select a team) and an Entra group (Select a group). Type at least 2 characters to search for a group.
3. Use a security group or a private Microsoft 365 group. A Public Microsoft 365 group shows a Public badge and cannot be used.
4. Order matters: when someone is in several mapped groups, the team higher in the list wins.
5. Choose Save mappings. You can map up to 100 teams.

Turn it on

1. Turn on Roles from Microsoft Entra and Teams from Microsoft Entra. Both are off by default. A switch that cannot be turned on yet says why, for example "Grant admin consent first." or "Select a team for new people first."
2. A dialog lists what changes. A role or team you change by hand in Worktivity is reverted at the next sync. Choose Turn on.
3. Under Employees, the role and team fields of people who sign in with Microsoft are locked and show "Managed in Microsoft Entra". Change them in Entra.

Roles are applied by the directory check, not when someone signs in. A person's team can also change at sign-in, when they have joined a mapped group. If a sync would change more than half of your people, it stops before anything is changed, emails your owners and shows Changes are on hold with examples of the planned changes. If they look right, choose Apply changes and confirm; the approval works once and is valid for 30 minutes. If they look wrong, fix Entra first, because nothing is applied until you approve.

How often does the sync run, and what does Sync now do?

The directory check runs about every 15 minutes. Sync now on the card starts a check right away. After you select it you see "Sync requested; it can take up to a minute to start". Each organization can use it once every 5 minutes; until then the button reads "Try again in N min". The card shows when roles and teams were last synced and how many people were checked. The sync exists for Microsoft Entra only.

What happens when someone leaves or is blocked?

With Microsoft Entra, the next directory check blocks a person who is deleted, disabled or no longer assigned, so it takes about 15 minutes. Once someone is blocked in Worktivity, whether by the check or by you under Employees, their web and app sessions stop working, usually within about two minutes. This matters because a desktop app session otherwise lasts about 3 years.

• The check blocks only when Entra clearly shows that the person is deleted, disabled or unassigned. Errors and unclear answers never block anyone.
• Owners are never blocked automatically.
• If a check would block more than half of your connected people, nobody is blocked, your owners are notified and the card shows the check as paused.
• People are never unblocked automatically. If someone returns, choose Unblock employee under Employees.

What does Google Workspace offer, and what does it not?

Google Workspace works for sign-in, but not for directory sync.

• Available: Connect Google Workspace on the Security tab, Continue with Google, automatic account creation on the first sign-in for people on your Workspace domain, Require SSO (with the owner exception) and desktop sign-in with a code. There is no approval step, so it works right after you connect.
• Not available: automatic deactivation, role mapping, team mapping and Sync now. Worktivity does not read your Google directory, so when someone leaves, choose Block employee under Employees yourself.

What do I do when someone cannot sign in?

• "Your organization has no free seats. Ask your admin.": all seats are in use. Block someone who no longer works with you (Block employee under Employees) or add seats to your subscription, then ask the person to sign in again.
• "This email address is already used by another Worktivity account. Ask your admin for help.": the email address belongs to an account in another organization. The person signs in with that account and connects Microsoft under Account settings, or contacts support.
• "Your organization has not finished connecting Microsoft sign-in. Ask your admin.": the card shows Pending admin consent. Grant admin consent, then ask the person to sign in again.
• "Your account has been locked. Contact support@useworktivity.com.": the person is blocked in Worktivity. If that was a mistake, choose Unblock employee, and check the Entra assignment first, or the next check blocks them again.
• "Sign in with your password once, then connect your Microsoft account in your account settings.": the person is an owner or co-owner, or the email also belongs to an account in another organization. They sign in with the password once and connect Microsoft under Account settings. If Require SSO is on, a co-owner cannot sign in with a password: turn Require SSO off for a moment, or let them connect from a session that is still open.

If a problem remains, write to support@useworktivity.com with the time of the attempt. Do not send passwords or codes. For the employee side of the sign-in, see How do I sign in with Microsoft or Google?.