In one sentence
Members can sign in to QFormance with their Google Workspace or Microsoft 365 account — admins decide whether SSO is allowed and which email domains are accepted, and accounts are still invited-only, even with SSO turned on.
- SSO doesn't create accounts on its own. An admin still has to invite the matching email address before someone can sign in.
- Domain restriction in the auth policy applies to SSO too — out-of-policy emails are rejected at the callback.
- The Google / Microsoft account used for SSO is independent of the same provider used for the Calendar / Outlook integration on your profile. They can be the same account or different.
Signing in with SSO
On the login page, click Google or Microsoft above the password form. You'll be redirected to the provider, asked to approve QFormance's access to your basic profile, and bounced back already signed in.
The first time you sign in with SSO, QFormance links your Google / Microsoft email to your existing QFormance account — provided your administrator has invited you with the matching email address.
Setup (admin)
SSO is enabled at the org level by your QFormance administrator. They:
- Decide which providers to allow in Admin → Organization → Auth & Sign-in Policy (the Allowed sign-in methods list).
- Coordinate with platform setup so the underlying Google / Azure OAuth apps are registered. (One-time, platform-side.)
Once both layers are in place, the SSO buttons appear on the login page automatically.
Domain restriction
If the organization has populated Allowed email domains in the auth policy, only members whose Google / Microsoft email is in that list can sign in. Out-of-policy users see "Your email domain isn't permitted to sign in to this organization."
Invited-only
QFormance is invited-only. SSO does not let strangers create accounts: an SSO sign-in is rejected with "This account hasn't been invited" unless an administrator has already invited the matching email address (via Admin → Users → Add member).
This is intentional. SSO simplifies sign-in for members you've invited; it doesn't open the door to anyone with a Google or Microsoft account.
Linking to other Google / Microsoft integrations
The Google / Microsoft account you use for SSO sign-in is independent of the account used for the Calendar / Outlook integration on your profile page. They use different OAuth scopes:
- SSO — basic profile (email, name).
- Calendar / Outlook integration — calendar read / write.
You can use the same account for both, or different accounts — your choice. The two settings live separately.