Identity management and single sign-on

Click your organisation's name at the top left and choose Security and sign-in; only owners see this. At Signing in through your company, choose Connect. On the right, step by step, is how to register Flow in Entra ID, with the redirect address you fill in there.

The issuer URL is your provider's address; Flow reads the OpenID configuration there and refuses an address without a provider. Client ID and client secret come from the app registration; the secret can only be written, never read back.

People with an email address on these domains sign in through the provider; the provider handles two-step verification. Working at your organisation is not access yet: choose Only people who were invited and invite people under People. Only when really everyone needs Flow do you let in the whole domain — everyone then counts on the invoice.

Flow only sends people to your provider once DNS shows the domain belongs to your organisation; that way nobody else can claim your domain. Below the form is a TXT record: set it at your DNS provider (click the name or the value to copy it) and choose Check. Until then nobody signs in through this domain.

Piet works at your company and signs in at the provider just fine. But he was not invited: the portal does not let him in and says why. Nothing of him is kept.

Anna was invited. She types her work email address on the sign-in screen. The portal recognises the domain and immediately offers to continue with your organisation's sign-in: no Flow password, no second code from Flow.

The colleague lands on your provider's sign-in page, with the email address already filled in, and signs in there as always: with the provider's password and two-step verification. Flow sees neither.

The provider sends Anna back to the portal, which checks the sign-in and uses her invitation: she gets an account and is a member of your organisation straight away, with the role from the invitation.

Inviting everyone separately is a lot of work when a whole department uses Flow. Then choose, under Security and sign-in, ‘Also people in a group of your identity provider’ and name the group (the name or object ID from Entra ID, or an app role), with the role the group gives. Invited people still come in; the rest of the company does not.

Kees was not invited, but is in the group Flow-gebruikers. He signs in at the provider and is a member straight away, with the group's role. If he leaves the group, he loses access at his next sign-in; if you remove the group here, at once.