Let our people sign in with our company account

For organization admins. You need admin rights in your company's sign-in provider (Okta, Microsoft Entra ID, Google Workspace or another that uses OpenID Connect), and an email domain your organization has proved in atduty. Company sign-in needs the plan, which your trial includes: Billing shows where your organization stands.

Steps

1. In atduty: open Company sign-in. Under Connect your sign-in, give the connection a name, choose your provider in Provider, and choose Continue.
2. In atduty: the first step, Prove your domain, lists your proved domains. If there are none, prove one first in Web address and email domains.
3. In your provider: create a web application that uses OpenID Connect. In Okta it is an app integration (OIDC - OpenID Connect, Web Application); in Microsoft Entra ID, an app registration (Entra ID, then App registrations, then New registration); in Google Workspace, a client of type Web application, made in the Google Cloud console under Google Auth Platform, then Clients.
4. In your provider: paste the Redirect URI that atduty shows under Tell your provider about atduty, and allow the scopes it lists.
5. In atduty: under Tell atduty about your provider, paste the Issuer URL, the Client ID and the Client secret from your provider, and save.
6. In atduty: under Who gets in, and how, choose who gets an account and how two-factor is handled.
7. In atduty: choose Run a test and sign in at your provider as a test user. Nothing is created; you see what your provider sent.
8. In atduty: when the test passes, choose Go live.

The first time someone signs in through your provider, atduty asks them to accept the Terms of use on one more page, and makes their account only then.

If it doesn't work

• “your provider gave an address that is not at one of your verified domains”: the test user's address is not at one of your proved domains.
• “your provider refused the client ID or secret”: copy the client ID and secret again; a secret is easy to cut short. Microsoft Entra ID and Google show a secret only once: if you no longer have it, make a new one there and paste that. In Microsoft Entra ID, the secret is its Value, not its Secret ID.
• “your provider refused the sign-in”: in your provider, check that the test user is assigned to the application.
• Go live stays off: an administrator needs their own password or passkey and two-factor first, so your organization can still get in if your provider is down.