Your identity provider, your rules
Admins, moderators and team leads normally sign in to the admin panel with the chat platform they already use. On the Business plan, they can sign in through your identity provider instead: Okta, Microsoft Entra ID, Google Workspace, or anything that speaks SAML 2.0 or OpenID Connect.
- Sign in by email domain: people type their work email and go straight to your identity provider.
- Or use your own link: each workspace gets a sign-in link that skips the email step.
- One sign-in to link: the first time someone uses single sign-on, they also sign in once through the chat platform, so Pointd Pal knows which person they are. After that, your identity provider is enough.
Make it the only way in
Turn on SSO required and the admin panel only accepts your identity provider. Sessions started any other way end at once. Turning it on is only possible from a single sign-on session, so you can’t lock yourself out by accident.
If your identity provider has an outage, the workspace’s owner on the chat platform can still get in, and every time they do it’s in the audit log.
Your domain, verified
Before your email domain sends anyone to your identity provider, you prove you own it by adding a DNS record. Until then, nobody is routed by that domain, and no other workspace can take it once you’ve verified it.
What you keep control of
- Who can sign in doesn’t change: admins, the people your admins gave access to, moderators and team leads.
- Deactivated accounts are refused.
- Every sign-in and every change to single sign-on is recorded in the audit log.
Single sign-on is part of the Business plan. Email sales to talk about it.