Who may sign in, and what each person may do
Every suite signs people in the same way: credentials verified on the server, two-factor, single sign-on with the firm’s own Google or Microsoft directory, members kept in step with the directory by SCIM, and each person working in a role.
Who uses it
- Administrator
- Every member
What it does
- Credentials verified on the server, with lockout and revocable sessions; sign-in alerts.
- Two-factor sign-in, which a workspace can require.
- Single sign-on with Google or Microsoft Entra ID (OpenID Connect with PKCE), configured per workspace; it never creates accounts.
- SCIM 2.0 provisioning from Microsoft Entra ID, Okta or any SCIM directory: add people, keep titles current, suspend leavers.
- Roles and permissions per member; seats; dormant members found.
- An IP allow-list enforced at sign-in and on every request of the workspace’s sessions.
How it works
- Invite members and give each a role.
- Require two-factor; connect single sign-on and, if you have one, your SCIM directory.
- Optionally restrict sign-in to your own addresses.
The controls that protect it
- Microsoft sign-in is pinned to the workspace’s own directory.
- The allow-list refuses to be saved without the address of the administrator saving it.
