Workspace sign-in settings
Workspace sign-in settings control how your team authenticates. Review them with the person responsible for your organization's identity service before making changes that could interrupt access. Your own account security is separate from these workspace-wide settings.
Access needed
Access depends on your assigned permissions and workflow scope.
- Read or change authentication settings, domains and identity providers
identity.settings.manageThis grant is required for reads as well as writes. User management and own account security do not substitute for it. Last-sign-in-method protections still apply.
Role and permission labels
Typical responsibility: Authorized workspace sign-in administrator. Role names alone do not grant access.
- Manage workspace sign-in settings
Demo screenshots may show broader access than your account.
Review authentication settings
Open Access Control → Sign-in settings. The Sign-in settings tab contains password sign-in, required multi-factor authentication (MFA) and email domains.
| Setting | What it controls |
|---|---|
| Allow password sign-in | Whether users can sign in with email and password. |
| Require multi-factor authentication | Whether users must enroll in MFA to satisfy workspace sign-in requirements. |
| Email domains | Domains associated with this workspace. A domain can belong to only one workspace. |
The demo settings illustrate the controls, not a recommended security policy. Choose requirements appropriate to your organization.
Change authentication requirements
- Prepare affected users
Confirm who uses password sign-in or an external provider. If requiring MFA, explain enrollment and recovery arrangements before changing the requirement.
- Review the intended settings
Change only the required controls. Review email domains and authentication choices together before submitting the draft.
- Save and verify
Use Save changes in the unsaved-changes prompt. Read any validation or save error, then reload the settings to confirm the saved values. Test the intended sign-in flow with an appropriate account without abandoning your working session.
See Sign in and account access for the account holder's sign-in guidance. Keep recovery codes, passwords and authenticator setup details out of documentation screenshots and support messages.
Maintain email domains
Select Add domain, enter a domain such as example.com, then select Add domain in the dialog. Enter the domain only, without an email address, @ or https://. Review the domain list and use Save changes to persist the draft.
Adding a domain in the dialog does not save the workspace settings. Removing a listed domain also needs the final settings save. If a domain is already associated with another workspace, resolve that ownership issue rather than repeatedly resubmitting it. Domain association does not create users or grant roles.
Review identity providers
Select the Identity providers tab. Existing connections appear here; an empty state means no provider is listed for this workspace.
Supported setup types shown by the application are OpenID Connect (OIDC), SAML, LDAP and callback. Obtain the connection details from the administrator responsible for that service. These are sign-in connections, not notification delivery providers.
Prepare a provider connection
- Choose the correct type
Select Add provider and choose the protocol supported by your identity service. The provider type cannot be changed after creation.
- Enter the supplied configuration
Enter a Display name of up to 100 characters and the fields requested for that type. For OIDC, use the supplied Authority and Client ID; scopes, email claim and client secret must match the registered application configuration.
- Finish configuration before enabling access
Leave Enabled off while configuration is incomplete. Review all values before Save provider. Where the saved connection provides registration details, give those to the identity-service administrator to complete its configuration.
- Verify the complete sign-in flow
After an authorized enablement, test the intended workspace sign-in option with an appropriate account. Keep an existing working sign-in method until the alternative has been verified.
Before removing a provider
Review who depends on the connection and verify another enabled sign-in method works. Removing a provider unlinks its users from that provider and is refused if it would remove the last enabled sign-in method. Do not remove a connection as a substitute for disabling one person's account.
Troubleshooting
| Problem | What to check |
|---|---|
| This page is unavailable | Reading and changing these settings both require identity.settings.manage. |
| Password sign-in cannot be turned off | Another enabled sign-in method is required. Verify it works before switching. |
| A domain is rejected | Enter a domain only; check duplicates and whether another workspace owns it. |
| Added domain disappears after leaving | The dialog updates a draft; save the workspace settings too. |
| Provider sign-in fails | Check enabled state, external registration and type-specific configuration with your identity administrator. |
| Provider type needs changing | The saved type is fixed; plan a separate correctly configured connection. |
| Users are prompted to enroll in MFA | Check the workspace requirement and the account holder's enrollment state. |
What was verified
The live authentication settings, empty provider list, Add domain dialog and empty OIDC setup form were inspected in light theme. Dialogs were cancelled. No authentication setting, domain, provider, credential or MFA enrollment was changed. External provider configuration and sign-in were not tested.