Sign-in and two-factor
Signing in with Microsoft Entra ID or Google Workspace, how a sign-in is matched to a person's record, and the second factor everyone uses before data loads.
Microsoft Entra ID
Section titled “Microsoft Entra ID”Your IT team adds the HR system as an enterprise application in Entra ID, with SAML single sign-on. We send the values to enter, and the app’s SAML metadata lists them too.
- Assertions must be signed with SHA-256. Unsigned assertions are refused.
- Turn on Assignment required and assign only the people who should use the HR system.
- Require multifactor authentication for the app in Conditional Access.
- Optionally, membership of an Entra group can make someone an HR admin, applied at each sign-in.
A person is matched by their work email and bound to their Entra object ID. Entra never creates a login: HR creates it first and can make it Microsoft sign-in only, so no password exists.
Google Workspace
Section titled “Google Workspace”People sign in with their Google Workspace account, matched by work email in the same way.
Second factor
Section titled “Second factor”Everyone uses a second factor. With Microsoft sign-in, Entra’s own multifactor check counts. Otherwise, each person sets up an authenticator app the first time they sign in. No HR data loads until the second factor is checked.