Enterprise sign-in

Under Settings → „Sicherheit & SSO“ (Security & SSO) a workspace signs in through its own identity provider (SAML 2.0).

Owners and admins may read it. Every other role gets a "not found" page.

The page opens with „Zwei-Faktor-Authentifizierung“ (Two-factor authentication), which applies to every workspace and is described under Two-factor requirement. Below it come the three SSO cards, in the order you need them: „E-Mail-Domains“, „Unternehmens-Anmeldung (SSO)“ (Enterprise sign-in), „Anmeldeadresse für diesen Arbeitsbereich“ (Sign-in address for this workspace).

The signed-in product speaks German, so its labels are quoted in German throughout, with the English rendering in italics.

Step 1: Verify the domain

Add the domain. The page then shows you a TXT record with copy buttons:

• Name: _verstag-challenge.YOUR-DOMAIN
• Value: verstag-domain-verification=TOKEN — the token is 64 hexadecimal characters

Create the record in DNS, then press „Prüfen“ (Check). There is no automatic re-check: verification happens only when you press it.

The window is 14 days. If it expires without the record being found, you reissue the verification with „Nachweis neu ausstellen“ (Reissue verification) — and that gives you a new token, so the old DNS record becomes worthless.

An expired verification is not granted even if the record is now in DNS. Reissue it in that case and enter the new value.

A verified domain is withdrawn as soon as a check no longer finds the record. The same 14-day window then opens again — this time with the same token, so the record only has to go back.

Step 2: Set up the connection

The connection card opens with „Werte für den Identitätsanbieter“ (Values for the identity provider): Entity ID and ACS URL, each with a copy button. Those are the two values you enter over at the provider — they come first because the provider has to know them before its metadata is worth anything here.

Without a verified domain the card shows no form below that, only the sentence naming verification as the first step. Only afterwards can you enter the identity provider, pick the role for new members and switch automatic admission on.

You take the provider's metadata in one of two ways — the switch above the field picks it:

• „Metadaten-URL“ (Metadata URL) — the provider serves its metadata at a public address. That is how Microsoft Entra ID works.
• „XML-Datei“ (XML file) — the provider offers the metadata only as a file to download. That is how Google Workspace works. Nothing can be re-fetched from a file: after a certificate rotation at the provider, you upload the new file.

Step-by-step guides exist for the two most common providers: Microsoft Entra ID and Google Workspace.

An already active connection can be pointed at a different provider without re-verifying — after a certificate change, for instance.

Invitations

Whoever you invite under settings → members joins through the company account, provided their address sits under a verified domain. The role comes from the invitation, even with automatic admission switched off. The invite form names the domains this applies to.

• SSO enforced: addresses outside the verified domains cannot be invited. Invitees set no password.
• Password allowed: invitees under your domains may join with a password instead. Every other address joins with a password.

A deactivated person does not come back through the company account, not even with a new invitation. Reactivate them in the member list.

When the sign-in expires

With the sign-in requirement switched on, a sign-in through the identity provider stands for at most twelve hours; after that the workspace has it confirmed again.

When the window expires you land at your workspace's sign-in address with a sentence saying "expired". Signing in through the provider again is enough.

Without the sign-in requirement switched on, none of this applies.

When somebody should lose access

If somebody is blocked at the identity provider, a new sign-in becomes impossible at once. A running session ends only when the twelve-hour window expires.

Where access should end at once and for good, do both: block the person at the identity provider and deactivate the membership in the workspace. Deactivation ends access immediately, the block at the provider keeps it closed.

If you only deactivate here, the person does not get back in through the provider under their previous address — not even with a new account through automatic admission. If they change the address of their verstag account, though, automatic admission can take them in under the old address as a new member. Only the provider locks them out for good.

If someone should be able to come back through automatic admission, remove the old membership instead of deactivating it.

What an admin may operate

An admin sees the connection as four state rows — „Identitätsanbieter“ (Identity provider), „Rolle für neue Mitglieder“ (Role for new members), „Automatische Aufnahme“ (Automatic admission), „Verbindung“ (Connection) — and in the domain section the list, the status, the TXT record with its value, and the copy buttons.

What they may not operate: saving the connection, and in the domain section „Prüfen“, reissuing a verification and adding a domain. Where the form would be, they get a sentence saying who may.

An admin may operate the switch for the sign-in requirement. So they get exactly one of the card's two switches.

When the plan does not include it

Enterprise sign-in is included from the Growth plan up. On a smaller plan a sentence saying so stands in place of the form. Where a workspace loses the capability, the page says it differently from never having had it: existing sign-ins keep working.