Company sign-in: your people sign in through Microsoft 365 or Google Workspace

Company sign-in puts SMG Tools under the Microsoft 365 or Google Workspace your company already runs, so its passwords and two-step apply here and somebody it switches off is out of SMG Tools within a working day. It is part of Scale, and only the owner sets it up.

Prove your company’s domain

Open Team and find Company sign-in. Type your company’s domain — the part after the @ in your work email, such as henderson-hvac.com — and press Add domain. SMG Tools confirms it is you first.

The section then shows a record to add where your domain’s DNS is managed — your domain registrar, or whoever runs your website or email:

• Type: TXT
• Host: @ (the domain itself)
• Value: the line starting smgtools-verification=, with a Copy button beside it

Until the record is found the domain reads Waiting for the DNS record. DNS changes can take a few hours to show; press Check now whenever you like, and SMG Tools looks once a day by itself for the first thirty days. Once the record is found the domain reads Proven.

A few things it will refuse, and why:

• An address anybody can sign up for — gmail.com, outlook.com and the like. Anybody can have one, so it shows nothing about who works for you.
• A domain another SMG Tools business has proven. A domain belongs to one business. If it is your company’s, contact support; we will not say which business holds it.
• More than twenty domains. A business with several — a company that bought another, say — adds each one.

Leave the record in place. SMG Tools checks it again every week. If it goes missing the domain stays proven for a week while you put it back; after that it reads Not proven, nobody can ask to join by it, and you are emailed once with the record to restore. Putting it back and pressing Check now proves it again.

Connect Microsoft 365 or Google Workspace

When a domain is proven, press Connect Microsoft 365 or Connect Google Workspace beside it and sign in with your own work account on that domain. SMG Tools records which Microsoft organization or which Google Workspace your company signs in through, and shows who connected it and when.

It has to be a work account on the domain itself, which Microsoft or Google confirms belongs to it. A personal Microsoft account, a Google account outside Workspace, or an account on another domain is turned away, with the reason.

If your company only lets its administrator approve new apps, Microsoft or Google will say so when you sign in. Ask your administrator to approve SMG Tools once — the section links Microsoft’s steps for them — then connect again.

Disconnect takes the company account off the domain; the domain stays proven. Remove domain takes it off altogether, and another business could prove it after that. Both confirm it is you, and both stop requiring company sign-in for that domain.

Approve the people who ask to join

Somebody from your company who signs in to SMG Tools with their work account, and has no SMG Tools account yet, is offered Ask to join your business first — starting a business of their own stays a step further away. Their request reaches you in For you and by email, and waits on the Team page under Asking to join, with their name, their address and when they asked.

• Approve… opens the invitation form with their address already filled in. Choose their role — a preset or one you built — and send it. A role that needs an office seat can be chosen only while one is free, exactly as for any invitation; approving never adds a seat by itself. Their next sign-in with their work account opens the business with that role.
• Decline tells them, by email, that the business declined. They can ask again later.

A request nobody answers lapses after thirty days, and the person is told. Inviting somebody by email works exactly as it always has — and an invitation to somebody who has asked answers their request.

Nobody joins without you: signing in with a company account is a way to ask, never a way in.

Require everyone on the domain to sign in through the company

Once a domain’s company account is connected, Require company sign-in appears beside it. Before anything changes you see who it covers — 12 people sign in with an address on henderson-hvac.com; 3 of them sign in another way today — and you confirm it is you.

From then on, everyone whose sign-in address is on that domain, except you, signs in only through the company:

• A password, a passkey, or any other Google or Microsoft account is refused for them, with one sentence naming your company’s sign-in — “Henderson HVAC signs in through Microsoft 365. Use Sign in with Microsoft, with your work account.”
• Somebody already signed in another way is sent to the company’s sign-in at their next renewal, within fifteen minutes. If they are still signed in at the company, it is a moment’s redirect and they carry on where they were.
• An invitation to an address on the domain is accepted through the company account too.
• People whose address is not on the domain — a subcontractor with their own email — sign in exactly as before.

Your company’s sign-in also meets the business’s two-step requirement, if you set one, at either strength: the company’s own sign-in is where their two-step lives. See requiring a second factor.

The Team page shows, on each person’s card, whether they sign in through the company and whether it is required of them.

Stop requiring it asks you to confirm it is you, and every other way in works again at once. Somebody who never had a password sets one with Forgot password on the sign-in page.

Know what happens when somebody leaves

A session that began through your company lasts twelve hours. Then SMG Tools asks the company again:

• Somebody who still works there and is signed in at the company goes through without seeing anything.
• Somebody signed out at the company sees its sign-in page, signs in, and carries on.
• Somebody the company has switched off is turned away by the company’s own sign-in, and cannot get back in. If the company sends them back to SMG Tools, the sign-in page says the company did not sign them back in.

So switching a leaver off in Microsoft 365 or Google Workspace takes them out of SMG Tools by the next morning, without anybody remembering to. To take somebody out at once, remove them on the Team page.

Keep your own way in

You — the owner — are never required to sign in through the company, so a day when its sign-in is down never locks the whole business out. Before you can require it, SMG Tools asks for a way in of your own that does not depend on the company: a passkey, or an authenticator app with your password. The emailed code does not count, because it arrives in the company’s mailbox. Add either on your Security page.

If you leave Scale

The requirement stays on — lifting it would loosen your company’s security without anybody choosing to — and people from the company can no longer ask to join. Until you are on Scale again you can Stop requiring it, disconnect a company account or remove a domain, and nothing else.

If Microsoft or Google sends you back to sign in another way

On every plan, a Microsoft or Google sign-in reaches an SMG Tools account by its email address only when Microsoft or Google confirms the address belongs to that account. If it does not, the sign-in page tells you to sign in the way you usually do — then connect Microsoft or Google from your Security page, where your own sign-in proves the account is yours. An invitation can still be accepted with such an account, because the invitation’s link was sent to that address.