More secure sign-ins with mandatory SSO

Employees often use several applications during their working day. Remembering a separate password for each one is inconvenient and can introduce additional security risks. Single Sign-On offers a simpler and more controlled way to access Flexwhere.

What is Single Sign-On?

Single Sign-On, usually shortened to SSO, allows employees to access multiple applications using the account managed by their organisation. Instead of creating a separate Flexwhere password, employees sign in with their existing Microsoft or Google account. Authentication is handled by the organisation’s identity provider, so its existing access and security policies also apply when someone signs in to Flexwhere.

How does SSO work in Flexwhere?

SSO with Microsoft and Google is available as a sign-in method in Flexwhere. Organisations can also make SSO mandatory for everyone in their workspace.

When mandatory SSO is enabled:

• Employees can only sign in through the identity provider selected by their organisation.

• Signing in with an email address and Flexwhere password is no longer available.

• Employees cannot create, change, or reset a separate Flexwhere password.

• New users must be added to the workspace by an administrator before they can sign in.

Users who are already signed in will not be interrupted. The requirement applies when they need to sign in again.

What are the benefits of mandatory SSO?

Offering SSO as an option makes signing in more convenient. Making it mandatory gives the organisation greater control over access.

Fewer passwords to manage

Employees do not need another password specifically for Flexwhere. This makes signing in easier and reduces the number of passwords they need to remember.

Central control over access

User authentication is managed through the organisation’s existing Microsoft or Google environment. When someone leaves the organisation or their account access changes, this can be managed through the same identity provider.

A smaller attack surface

Removing password-based access means there is one less sign-in method that could be targeted. It also ensures that the organisation’s existing authentication policies are applied.

Less confusion for employees

Showing several sign-in options can leave employees unsure about which account to use. For example, someone may try to use a personal Google account even though their organisation manages access through Microsoft. Mandatory SSO gives everyone one clear route to Flexwhere.

Which options can administrators choose?

Administrators can enable Require SSO in the organisation settings of the Flexwhere Control Centre. They then select the identity provider their organisation uses:

• Sign in with Microsoft

• Sign in with Google

  
  

Only the selected option will be available to users. This prevents employees from attempting to sign in with an account that is not connected to their Flexwhere workspace.

Before enabling the setting, administrators should make sure that all employees have an account with the selected provider and have been added to the Flexwhere workspace.

What does mandatory SSO look like for users?

For employees, signing in remains simple. They select the Microsoft or Google option chosen by their organisation and authenticate using their existing work account.

They will no longer see the option to sign in with a Flexwhere password. If their account has not yet been added to the workspace, Flexwhere will ask them to contact their administrator.

This gives employees a clear sign-in experience while giving the organisation more control over who can access Flexwhere.