Single sign-on (SSO) lets employees sign in to TimeLeaf with their Microsoft or Google work account. You can make it the only way to sign in, and give people roles from their groups in your identity provider.
What you need
- The Professional plan or above.
- A TimeLeaf admin account.
- Microsoft Entra ID (Microsoft 365) or Google Workspace, and someone who can create an app registration (Microsoft) or OAuth client (Google) there.
TimeLeaf supports Microsoft Entra ID and Google Workspace only. SAML is not supported, so identity providers such as Okta, OneLogin or PingIdentity can't be connected.
Set up a provider
Create the app in your identity provider
Create an app registration in Microsoft Entra ID, or an OAuth client in Google Cloud, and copy its client ID and client secret. The step-by-step guides are in Microsoft 365 and Google Workspace, and the Single Sign-On page has a setup guide for each.
Add the provider
Go to Integrations › Single Sign-On and click Add Provider. Choose the Provider Type (Microsoft Entra ID (Azure AD) or Google Workspace) and fill in:
- Display Name, for example "Company SSO".
- Client ID and Client Secret.
- Tenant ID (Microsoft only): your directory's ID, a GUID.
commonandorganizationsare refused, because they would let any Microsoft directory sign in. - Email Domain (Microsoft) or Workspace Domain (Google), for example
company.com. TimeLeaf uses it to match an email address to this provider. For Google, only accounts in that Workspace can sign in, never a personal Google account.
Tick Set as active provider and save.
Copy the redirect URIs into your identity provider
Open the saved provider with Edit. Under Redirect URIs TimeLeaf shows two addresses with copy buttons. Add both to your app registration or OAuth client:
- The sign-in URI,
https://<your-workspace>.timeleaf.io/api/auth/sso/callback/<provider id>. - The calendar URI,
https://<your-workspace>.timeleaf.io/api/me/calendar/callback, used when employees connect their own calendars.
Each provider has its own sign-in URI, so you only see them after saving.
Test it
Sign out and sign in with the "Sign in with Microsoft" or "Sign in with Google" button.
Only one provider is active at a time. Use Set as active provider on a provider's row to switch.
People must exist in TimeLeaf first
SSO does not create accounts. An employee has to exist in TimeLeaf (added by an admin, invited, or imported with Directory Sync) before they can sign in, and the email address from your identity provider must match the email on their TimeLeaf profile. Someone who signs in with your provider but has no matching TimeLeaf account is refused.
Require SSO sign-in
SSO is optional by default: people can sign in with SSO or with their email and password.
To make it the only way in, turn on Require SSO sign-in on Integrations › Single Sign-On. From then on:
- Password, passkey and recovery-code sign-in is refused for everyone except account owners, and the sign-in page shows only the SSO button.
- Everyone signed in some other way (a password, a passkey or a recovery code) is signed out and has to sign in again with SSO. Account owners and the admin who turned it on stay signed in. The number of sessions ended is recorded in the audit log. A browser that is already open can take up to a minute to notice.
- You can't disable or delete the last active provider until you turn the setting off.
You can only turn it on when a provider is active and at least one account owner has a password. If not, TimeLeaf says what is missing ("Set up and enable an SSO provider first." or "Give an account owner a password before requiring SSO sign-in").
Owner sign-in. Account owners can still sign in with their password through the Owner sign-in link on the sign-in page, so a broken or unavailable identity provider can never lock your company out. Keep at least one owner whose password you know.
Personal access tokens, AI assistant connections and chat-app links that someone set up earlier are not sign-ins and keep working. They stop when you offboard the employee in TimeLeaf, not when you disable them in your identity provider.
Set roles from groups
Group → Role Mapping on Integrations › Single Sign-On gives people a TimeLeaf role from their groups in Microsoft Entra ID or Google Workspace.
Add a mapping
Click Add mapping, search for the IdP group by name or email, choose the Role (Employee, Manager or Admin) and a Priority, and click Save mapping.
It applies at sign-in
Each time someone signs in with SSO, TimeLeaf reads their groups and applies the matching mapping with the highest priority. On a tie, the higher role wins (Admin over Manager over Employee).
Things to know:
- Mappings run only for the active provider.
- Someone whose roles are locked (Lock roles on their row in People › Employees & Teams) is skipped; their roles stay as last saved by hand.
- Deleting a mapping doesn't change anyone straight away; their role is worked out again at their next sign-in.
- Finding groups needs an extra permission: the Microsoft Graph application permission
Group.Read.All, or for Google the scopehttps://www.googleapis.com/auth/admin.directory.group.readonlyon the directory-sync service account.
Troubleshooting
| Problem | What to do |
|---|---|
| A redirect error at sign-in | The sign-in URI in your identity provider must match the one under Redirect URIs exactly. |
| "No account" or refused after signing in with the provider | Add the person in TimeLeaf first, with the same email address as in your identity provider. |
| Require SSO sign-in can't be ticked | Make a provider active, and give at least one account owner a password. On a plan without SSO the setting can only be turned off. |
| The group search fails | Grant the group permission listed above, then try again. |