Require single sign-on for everyone
When everyone signs in with the company’s Google or Microsoft account, leaving the company means losing Freesbe along with email, and your identity provider’s own rules (its MFA, its device checks) apply to Freesbe too. This turns it on for Northwind Traders in the right order, so no admin gets locked out and nobody is surprised. An owner or admin does it.
Before you start
Section titled “Before you start”- Requiring SSO comes with the Corporate and Enterprise plans.
- Everyone needs a Google or Microsoft work account whose address matches their Freesbe email. People whose addresses differ should link the provider first (step 2).
- Scripts that sign in with a password lose access to the workspace once SSO is required. List them and move them to an app token first.
- Requiring SSO decides how people sign in, not who can join. To cover a whole company, pair it with email domains, so everyone at your domain can join on their own and has to sign in with your work accounts.
1. Sign in with the provider yourself
Section titled “1. Sign in with the provider yourself”Freesbe won’t let you require Google while you’re signed in with a password, so you can’t lock yourself out. Sign out and sign back in with the provider you’re about to require. Do the same for the other admins, or at least tell them.
2. Warn the team
Section titled “2. Warn the team”Send a message a day ahead:
From tomorrow, Freesbe signs you in with your Northwind Google account. If your Google address is different from the one you use in Freesbe, link it today: Preferences → My account → Sign-in → Google, Microsoft and Apple. If you sign in with Apple, you’ll be asked to continue with Google instead for this workspace.
Signing in with Apple doesn’t count: an Apple ID is a personal account no company manages.
3. Turn it on
Section titled “3. Turn it on”- Open Workspace settings → Security & compliance → Sign-in → Single sign-on.
- Under Members must sign in with, choose Google, Microsoft or Google or Microsoft.
Choose Any sign-in method to turn it off again. If your phone approves sign-ins, Freesbe asks you to verify it’s you first, since this is a change that can lock people out.
What changes for people
Section titled “What changes for people”- Anyone using the workspace with a password, a sign-in code or a passkey is signed out of that workspace right away and asked to continue with the required provider. Their Freesbe account stays the same: signing in with the provider links it to their account.
- Linking works when the provider’s address matches their Freesbe email. Otherwise they connect the provider in Preferences → My account → Sign-in → Google, Microsoft and Apple first.
- Other workspaces they belong to aren’t affected, and emailed sign-in codes don’t open this one.
- For Microsoft, work, school and personal accounts can sign in unless your Freesbe server is set up to accept only work and school accounts, or only your organization’s directory. For Google, any Google account with a confirmed address can.
- Turn on multi-factor authentication as well, or rely on your provider’s: signing in with Google or Microsoft counts as the second step by itself.
- The Admin Center always asks for its own strong second step, whatever the sign-in method.
- The change goes in the audit log, under Security → Logs in the Admin Center.
See Single sign-on for the details.
Answers come from the Freesbe guides and are written by AI, so check the linked guide before relying on one. Please don't include personal details such as emails or passwords.