Single Sign-On (SSO)
Users can sign in to ArkCloud RCM with Google when the deployment is configured for it. Microsoft Entra ID sign-in is written but not switched on and has no sign-in button, and SAML (the route for Okta and OneLogin) is switched off.
Microsoft or SAML single sign-on (Entra ID, Okta, OneLogin)Not available
Not available. Microsoft sign-in is written but not switched on and has no sign-in button; SAML is refused until ArkCloud can verify SAML signatures. There is no SCIM user provisioning.
Identity providers
Google (Google Workspace and Google accounts)
Available when configuredShown as a “Continue with Google” button on the sign-in page when the deployment sets GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET. Which Google accounts can complete sign-in also depends on how the deployment’s Google OAuth client is set up (an “Internal” client admits only the operator’s own Workspace), so ask ArkCloud whether your domain can use it.
Microsoft Entra ID (Azure AD)
No sign-in buttonWritten but not switched on for ArkCloud's hosted service. The provider is registered only when the deployment sets AZURE_AD_CLIENT_ID and AZURE_AD_CLIENT_SECRET (and optionally AZURE_AD_TENANT_ID, default “common”), and even then the sign-in page has no Microsoft button, so users cannot start a Microsoft sign-in from it.
SAML 2.0 (Okta, OneLogin and other SAML identity providers)
Switched offSAML sign-in is disabled until ArkCloud can verify SAML signatures. The sign-in route redirects with an error, the assertion endpoint refuses every assertion, and enabling SAML in settings is refused. An SP metadata route exists, but nothing can sign in through it.
What happens at first sign-in
Existing user. If a user with the same email already exists and is active, the Google account is linked to it and the user signs in with their existing role. A user whose account belongs to a different organisation from the one being signed in to is refused.
New user. Unless the deployment sets AUTH_ALLOW_AUTO_CREATE=false (the default is on), ArkCloud creates the user just in time, with the AGENT role, in the organisation identified by the sign-in address or by the email domain. An administrator changes the role afterwards.
New user with no organisation. If no organisation can be identified - the address has no account and its domain is not linked to one - a Google sign-in becomes a sign-up: the person is asked to name a new organisation and accept the terms, and becomes its administrator with the same 14-day trial and sample data as an email sign-up. Only an address Google has verified is accepted. Whether people outside the operator's own Workspace can reach this depends on the Google OAuth client's audience (see above).
Domain check. A new user is accepted only if their email domain is a verified sign-in domain of the organisation (added and DNS-verified by an ADMIN in Settings → Security → SSO), or is listed in the deployment's AUTH_ALLOWED_EMAIL_DOMAINS. If the organisation has no verified sign-in domain, nobody can join it by signing in with Google. An administrator creates the user first (Administration → Users); after that the person signs in with Google as an existing user. Demonstration organisations are the exception and still accept any new Google sign-in.
Leavers. Disabling someone in Google stops new sign-ins, but ArkCloud is not told: deactivate the user in ArkCloud as well.
Not available
Security notes
Each Google sign-in records a sign-in event in the organisation's audit log.
ArkCloud's own two-factor check (an authenticator-app code) applies to Google sign-ins as well: a user who has set it up is asked for a code after Google, administrators must set it up, and an organisation can require it for every user from their next sign-in. Demonstration organisations are exempt. Whatever your Google account or Workspace enforces applies before that.
Keep at least one administrator who can sign in without Google, in case the Google configuration changes.
Need a different identity provider?
Tell us which provider you use. We will say plainly whether it can be supported and when.
Contact Support