Configure company sign-in

Overview

Company sign-in lets an organization require its own Microsoft 365, Okta, or other configured identity provider. Email-domain rules are separate: they limit invitation and notification addresses but do not prove how a person signed in.

Test company sign-in with an active administrator before making it required.

Access needed

These protected actions require a recent MFA check.

Configure an identity provider

1. Open Settings > Security & sign-in > Identity providers.
2. Add or open the company provider.
3. Enter the provider settings supplied by your identity administrator.
4. Save and activate it.
5. Test sign-in with an active FTE Tree administrator.
6. Review the test account’s access.
7. Only then make the provider required.

Only one company sign-in method can be required at a time. Changes take effect when a person next opens a page or takes an action.

Having the same email domain is not enough. The person must use the configured company identity.

Activate or deactivate a provider

Company sign-in services are kept in history rather than deleted. Deactivate stops required sign-in through that service and ends access provided through its groups while preserving the saved setup and activity history.

To reuse it, activate the provider, review its settings and group access, test it, and then require it if appropriate.

Do not deactivate the only working path during an outage without understanding how administrators will continue to enter the organization.

Connect company groups to roles

External groups can grant FTE Tree access roles:

1. Choose the company group.
2. Choose the FTE Tree role.
3. For a role limited by department, choose All departments or specific departments.
4. Review the permissions and departments.
5. Activate the connection.

A blank department selection grants no department access. Administrators cannot grant permissions or departments beyond their own authority.

Group connections are kept in history and use Activate and Deactivate. Review them whenever company group membership, department structure, or FTE Tree roles change.

Configure allowed email domains

Open Settings > Organization > Email policy to limit invitation addresses and organization email recipients to exact domains.

For example, allowing company.com permits user@company.com but not user@mail.company.com. Add each permitted domain separately. Leaving the list blank permits any domain.

The rule applies to:

• Invitation addresses.
• The verified account email used for organization notifications.

It does not select a sign-in method, confirm company identity, or remove an existing membership. Use required company sign-in for that purpose.

Review changes

People with Manage sign-in security can review provider and enforcement history. People with Manage user access can review external group mappings and synchronized access. People with Manage organization settings can review email-policy history.

One responsibility does not reveal another responsibility’s protected history unless the person has both kinds of access.

Safe rollout checklist

1. Keep at least one active administrator able to sign in.
2. Test provider sign-in before enforcement.
3. Map a small pilot group first.
4. Confirm the role and department access.
5. Require the provider.
6. Verify normal and administrator sign-in.
7. Run an access review after the latest group information appears in FTE Tree.
8. Document the recovery contact within your organization.

Common questions

Does an allowed email domain require SSO?

No. Email policy and sign-in enforcement are separate.

Why did a group member get no department data?

The connected role may require department access, and a blank department selection grants none.

Can I delete an old provider?

Providers are kept in history. Deactivate one that should no longer be used.