SSO
Let people on your email domains join on their own, and send them to Microsoft sign-in.
SSO is a paid add-on. With it, anyone whose email is on one of your verified SSO domains joins your organisation on their first sign-in, with no admin adding them. You can also enforce SSO, which sends them to Microsoft sign-in instead of an emailed code.
Without the add-on, Settings > SSO says SSO isn't active. Add it on the Billing page first. You can add and verify domains before then.
Continue with Microsoft on the sign-in page works for everyone, with or without the add-on. It signs in only people who are already users.
Only your own admins can change SSO, not Panoptic support.
Add a domain
Open Settings, then select Manage SSO.
Under SSO domains, enter the Domain, for example acme.ie, and select Add domain.
Add the TXT record shown to the domain's DNS. Copy its Name and Value exactly.
Select Verify.
New DNS records can take a while to appear. If Verify says the record isn't there yet, try again later.
- Free mail providers, such as gmail.com, can't be added.
- An organisation can have up to 20 SSO domains.
- Only one Lodestar organisation can verify a domain.
Choose the access level people join at
Under Access level for people who join, choose Staff or Read-only. The default is Read-only. Nobody joins as an admin.
Raise or lower anyone afterwards on the Users page. Users shows Joined through SSO for these people.
Enforce SSO
Under Enforce SSO, select Switch on. You need at least one verified domain first.
When someone enters an address on one of your verified domains on the sign-in or sign-up page, Lodestar sends them to Microsoft sign-in instead of emailing a code.
Enforcing SSO steers people to Microsoft. It does not stop someone who reaches the emailed code another way.
Remove a domain
Select Remove on the domain, then Remove to confirm. Nobody new joins through it. People who already joined keep their access.
Removing your last verified domain also stops enforcing SSO.
How people join
People sign in as usual with an address on a verified domain. Lodestar shows Continue to and your organisation's name. See Sign in.
Someone you removed from Users does not join again through SSO. Select Give access back instead.
While Lodestar is closed for billing, nobody new joins through SSO.