Choose how people sign in
Nobody signs in to Sanitized AI with a password. Depending on the methods you turn on, people sign in with a single-use link sent to their work email, or with their Google, Microsoft, or Okta account. Admins choose the methods in My Organization > Sign-in & provisioning.
Sign-in methods
The Access policy card lists the methods. The following table describes each one.
| Setting | What it does |
|---|---|
| Enable email magic-link sign-in | People get a single-use sign-in link by email. On by default. Admins whose email is at an approved company domain can always use it, even when it’s off. |
| Enable Google sign-in | People can sign in with the Google account that uses their work email. |
| Enable Microsoft sign-in | People can sign in with the Microsoft account that uses their work email. |
| Enable Okta sign-in | People can sign in through your Okta. Needs setup first: see Configure Okta SSO. |
| Automatically create users from approved domains | Anyone from an approved company domain gets an account the first time they sign in with Google, Microsoft, or Okta. |
| Require Okta for regular users | Everyone except admins must sign in through Okta. |
After you change these settings, click Save access policy. At least one method must stay on.
The sign-in page only shows each person the methods open to them. For what people see, see Signing in.
Turn on Google or Microsoft sign-in
- Go to My Organization > Sign-in & provisioning.
- In Access policy, select Enable Google sign-in, Enable Microsoft sign-in, or both.
- Click Save access policy.
People then see Google and Microsoft buttons after they enter their work email. The account they sign in with must use the same email address as their Sanitized AI account. If the addresses differ, sign-in is refused.
Some Microsoft organizations require an administrator to approve new apps before people can sign in with them. If people see an approval request, ask your Microsoft administrator.
Unless you also turn on automatic creation, people must already be added and activated on the Users page.
Create accounts automatically
With Automatically create users from approved domains, you don’t have to add everyone by hand. When someone from an approved domain signs in with Google, Microsoft, or Okta for the first time, Sanitized AI creates their account:
- They join as an active Member, in the department Unassigned.
- They use a seat. If your organization has no seats left, the sign-in is refused.
- They don’t get a welcome email.
- The first time, they only see the company sign-in buttons, not the email link.
Afterwards, set their department and manager on the Users page.
To use automatic creation, you need at least one approved company domain and at least one of Google, Microsoft, or Okta sign-in.
Approve your company domains
A company domain is the part of an email address after the @, such as
example.com. Approved domains let Sanitized AI match people to your
organization for automatic creation and for Okta.
- In Company domain approval, enter the domain, for example
example.com. - Click Submit domain. The domain shows pending approval.
- Wait for Sanitized AI to approve it. The domain then shows approved.
No DNS changes are needed. If a request is rejected, the reason appears under the domain, and you can click Resubmit.
While email, Google, and Microsoft sign-in are all off, you can’t remove an approved domain. Okta and the admins’ email link only work for addresses at an approved domain, so turn one of the other methods on first.
Require Okta
Require Okta for regular users makes Okta the only way for non-admins to sign in. It hides the email link for them, and hides the Google and Microsoft buttons for everyone.
Admins whose email is at an approved company domain always keep the email link as an emergency way in, in case an Okta setting breaks, even when Enable email magic-link sign-in is cleared. You can only require Okta while Okta sign-in is on.