Configure company sign-in

Company sign-in lets your organization require its Microsoft Entra ID or Okta sign-in service. FTE Tree offers it as a separately quoted, one-time setup service for either edition, with no recurring company-sign-in fee. Ordinary Google and Microsoft account sign-in are already included and do not need this setup.

FTE Tree must enable setup before an administrator can connect and test the company sign-in service or require members to use it. Company sign-in confirms who the member is; it does not add them to the organization or assign roles, permissions, or department access. Your company service’s multi-factor authentication (MFA) is separate from FTE Tree’s MFA. Require strong verification, preferably a passkey or security key, in your company sign-in service. Company sign-in changes require verification with an FTE Tree passkey within the previous five minutes.

Account access and employee departures

Company sign-in confirms identity. FTE Tree memberships, roles, and department access are managed separately. Company sign-in does not automatically create FTE Tree accounts or add people to your organization. When someone leaves, remove their company access and deactivate their FTE Tree membership promptly. Removing a membership preserves its recorded history and does not remove access the same account has to other organizations.

Before you begin

To do this	You need
Ask for setup to be enabled	Contact FTE Tree Support through your approved support process.
Configure, test, activate, suspend, remove, or enforce company sign-in	Manage sign-in security for the organization.

Work with the person who manages your company’s sign-in service. They prepare the connection in Microsoft Entra ID or Okta and supply the values requested by the form:

Form field	What your sign-in administrator supplies
Provider	The company sign-in service your organization uses
Issuer URL	The exact address identifying your organization’s sign-in service
Client ID	The identifier assigned to this FTE Tree connection
Certificate or client secret	For Microsoft Entra, generate and register a certificate. Enter a secret only for an approved connection that needs one.
Callback URL	The return address shown by FTE Tree, which your administrator adds to the company service

Use the details for your own organization’s approved connection. The form checks supported addresses and explains anything that needs correcting. Contact FTE Tree if your service or company sign-in address is not accepted.

Ask FTE Tree Support to enable company sign-in setup for your organization.
Open Settings > Security & sign-in > Company sign-in.
Select the provider and enter its exact issuer URL and client ID.
Copy the Callback URL shown by FTE Tree into the FTE Tree connection settings in your company service. It must match exactly.
For Microsoft Entra, choose Generate a certificate for Microsoft Entra (recommended) and leave Client secret blank. For an approved secret-based connection, enter the client secret directly in the protected form. Never include credentials in email or the reason for change.
Enter a short reason for the setup and choose Validate and save. If you generated an Entra certificate, choose Download public certificate and register it in Entra before testing.

FTE Tree checks that the issuer matches the selected provider. Generated private keys stay protected and are never displayed. Public certificates can be downloaded again; replace them before the expiration date shown on the page. A client secret is accepted only in the protected form and is not displayed again.

Saving a provider change or a new credential clears the previous test while preserving required company sign-in. Have both administrators test again after the change. Only Stop requiring company sign-in allows other sign-in methods for organization work.

Test before enforcement

Keep two active sign-in administrators with working FTE Tree authenticators and recovery codes.
On the Company sign-in page, choose Test company sign-in.
Sign in with the intended provider account for an active administrator who has the Manage sign-in security permission.
Confirm that you return to the correct organization and retain the expected FTE Tree role and department access.
Repeat the test with a second administrator who has Manage sign-in security and a working FTE Tree authenticator. Test additional intended members before enforcement.
Copy the Company sign-in URL from the page and give it to intended members through a secure channel your organization uses.

A successful sign-in records each eligible administrator’s test automatically. Both administrators must retain active membership, sign-in permission, a connected company account and an authenticator. A matching email address, general Microsoft sign-in, provider group, or another provider does not count as the test.

If your identity confirmation expires while you are signing in, confirm your identity again and restart company sign-in. Your company connection is completed only after that new sign-in succeeds.

Choose Require company sign-in only after the page shows two eligible administrators have tested and every intended member is ready.

When enforcement is on, members must use the exact configured provider. A passkey, email code, general Microsoft or Google sign-in, or FTE Tree authenticator code alone cannot bypass the requirement.

Before enforcement:

Confirm that every intended member has an account in the provider.
Keep both tested sign-in administrators active and connected, with working FTE Tree authenticators and recovery codes.
Record who can authorize emergency enforcement changes.
Review FTE Tree roles and department access separately.
Confirm who handles sign-in service problems and helps new members join.

Members use the organization-specific Company sign-in URL. The Callback URL returns people to FTE Tree after they sign in through the company service. Give members the Company sign-in URL to start signing in.

Rotate a client secret

Create a replacement secret at the provider before revoking the current one when the provider supports overlapping secrets.

Open the Company sign-in page, enter the new client secret, record the reason, and choose Validate and save. Leave the provider, issuer, and client ID unchanged for a routine rotation. The replacement clears the previous sign-in test. Company sign-in remains required, so have both administrators test the replacement.

Have both administrators complete new sign-in tests. Remove the old connection key from the company service only after both tests succeed and you have confirmed how to recover access if needed. Company sign-in remains required while you replace the secret. Use Stop requiring company sign-in if your organization decides to allow other sign-in methods.

Change or remove a provider

Changing the provider, issuer, or client ID changes how members enter the organization. First stop enforcement, have every affected user remove the old company connection from personal sign-in methods, and confirm no linked company accounts remain. Then save the replacement configuration and have both administrators test it.

To remove the configuration, explicitly stop requiring company sign-in, suspend the provider, remove every linked company account, enter the reason, confirm the removal, and choose Remove configuration. FTE Tree will not remove a configuration while linked accounts remain.

If the provider is unavailable

An authenticator app does not bypass required company sign-in. Restore the provider when possible. A person with Manage sign-in security can explicitly stop requiring company sign-in from the protected Company sign-in page. Suspension keeps company sign-in required and does not allow email-only access.

If no administrator can enter the organization, contact FTE Tree Support with the organization name, provider name, approximate start time, visible error, affected users, and the person authorizing recovery. Never send passwords, sign-in codes, authenticator codes, recovery codes, or provider credentials.

After recovery, activate the provider, have both eligible administrators test again, and require company sign-in again only after normal and recovery access are confirmed.

Review activity

Use Activity history from the Company sign-in page to review who configured, tested, activated, suspended, enforced, or changed the provider and why. Client secrets are never included in activity.

Form choices

Use this reference to choose form values. Available choices depend on the task, selected date, and your access.

Provider

Choose the identity provider your organization uses for company sign-in.

Use the configuration details for that provider and organization account. Saving a configuration is separate from testing it and requiring company sign-in. Complete both administrator tests before enforcing it, and use the organization’s authorized recovery process when sign-in cannot continue.

For exercises that change records, use a separate practice organization and complete the preparation below.

Practice steps and checks

This lesson is optional. Your organization must first arrange company sign-in with FTE Tree.

Have the authorized administrator enter the provider details.
Have two sign-in administrators complete the provider test before turning on the requirement for everyone.
Sign in as an ordinary test user and check the organization reached.
Check that an administrator can still sign in and complete required FTE Tree MFA.
Review Activity history for the changes.

A successful company sign-in and FTE Tree’s own MFA check are separate steps. Email-domain rules are also separate.

Follow the protected forms to change a secret or suspend the provider when needed. Do not put secrets in notes or screenshots. Use sign-in help if the test cannot finish.

Company sign-in stays required while you replace connection details, correct a failed test, or suspend the service. It also stays required if setup becomes unavailable. If the required service is unavailable, members cannot enter the organization using another sign-in method, even if they already signed in with an email code. An administrator must choose Stop requiring company sign-in, verify an FTE Tree passkey within five minutes, and enter a reason to allow other methods. Contact Support if the administrator cannot reach the recovery settings.

Suspending the connection, replacing its sign-in details, or making setup unavailable does not allow members to use another sign-in method for organization work.

An administrator with Manage sign-in security can choose Manage company sign-in on the sign-in recovery page and verify an FTE Tree passkey within five minutes. The recovery page remains available if setup is disabled or subscription access has expired. To permit another sign-in method, choose Stop requiring company sign-in and record the reason. Support can suspend or restore setup availability; your organization administrator makes this policy decision. Normal membership, permissions and subscription requirements still apply to organization work.

Verify an FTE Tree passkey within five minutes before changing company sign-in settings. After restoring the provider, have both administrators test again before requiring it.

Account access and employee departures

Before you begin