How do we set up single sign-on (SSO) with Microsoft or Google?

Single sign-on (SSO) lets your team sign in to Trace with their existing work account instead of a separate Trace password. Your organisation's own security rules (such as MFA and account suspension) then apply to Trace too.

Trace supports Microsoft (Microsoft Entra ID, formerly Azure Active Directory) work or school accounts, and Google accounts.

Signing in with Google

There's nothing to set up. On the Trace sign-in page, click Sign In using Google and choose your account.

Setting up Microsoft sign-in

Who should do this: a Cloud Application Administrator or Global Administrator in your organisation.
Where: the Microsoft Entra admin center.

1. Sign in to the Microsoft Entra admin center with your admin account.
2. Approve the "Our Trace" application. In the left menu, go to Enterprise applications and search for Our Trace.
   • If it's there, open it and check the right users or groups are assigned.
   • If it isn't there yet, it appears automatically the first time someone in your organisation clicks Sign In using Microsoft on the Trace sign-in page. When prompted, click Accept to grant permission on behalf of your organisation.
3. (Optional) Choose who can use Trace. In Enterprise applications → Our Trace → Users and groups, add the people or groups who should have access. To block everyone else, turn on Assignment required.
4. Test it. Go to the Trace sign-in page and click Sign In using Microsoft. If you get in, you're all set.

Making SSO the only way to sign in

Your company can require everyone to sign in with SSO. Email and password sign-in, and password resets, are then turned off for your users. Contact us to have it switched on.

Good to know

• People still need a Trace user before they can sign in. An Admin can add them in Manage Users.
• Trace doesn't ask for its own MFA code when you sign in with Microsoft or Google. Your organisation's settings apply.