Single sign-on
Let staff sign in with their Google or Microsoft work account, or your SAML identity provider, and keep accounts in step with SCIM.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
Single sign-on (SSO) lets your staff sign in to the Console and the Agoo Workspace app with the work account they already have: Continue with Google or Continue with Microsoft on every plan, Free included, and your own SAML identity provider on Pro and above.
| Plan | Single sign-on |
|---|---|
| Free | Sign in with Google or Microsoft, with your rules for which accounts, and require it |
| Starter | The same |
| Growth | The same |
| Pro | + SAML single sign-on and SCIM provisioning (planned) |
| Enterprise | + Your own identity provider set-up (planned) |
Google and Microsoft sign-in comes at no extra price, on every plan. Whatever you require, the Owner always keeps a password and an authenticator, so nobody can lock your organisation out. You can also start your organisation with Google or Microsoft.
Sign in with Google and Microsoft is in the Console and Agoo Workspace on iPhone, iPad and Android, for organisations in early access. SAML and SCIM are planned. Agoo Admin, Agoo's own administration, is always a password and an authenticator.
Sign in with Google or Microsoft (every plan)
On the sign-in page, people choose Continue with Google or Continue with Microsoft, sign in with their work account there, and come back signed in to Agoo. In the Agoo Workspace app the same buttons open Google's or Microsoft's own page in a secure browser sheet, so an account already signed in on the phone is offered straight away, and the app opens signed in. If your account uses two-step verification (Owners and Admins always do), Agoo still asks for the authenticator's code next: Agoo can't see whether Google or Microsoft asked for a second step, so it never assumes they did.
On the sign-in page it's sign-in only: nobody gets an Agoo account just by signing in. People are invited first. The first time someone chooses Google or Microsoft, Agoo links that account to their Agoo account only when Google or Microsoft confirms the email address is theirs and it's the same as their Agoo account's. Otherwise they sign in with their password or an email code, and add it themselves.
If Google or Microsoft confirms an email that has no Agoo account, the sign-in page says so and offers two ways on: start an organisation with that account from the sign-up page (see Sign up with Google or Microsoft), or, to join a team that already uses Agoo, ask its Owner or an Admin to invite you.
Add Google or Microsoft to your own account
Open Your account → Sign-in and security → Sign-in methods
You see your password, your email code (always there) and any Google or Microsoft accounts you sign in with. In the app, it's Account → Sign-in methods.
Choose Add Google or Add Microsoft
Confirm it's you first, with your authenticator's code, or if you don't use one, a code Agoo emails you. Then choose your account. It can have a different email from your Agoo account, unless your organisation only allows its own accounts.
You can remove one the same way. You can't remove the one you're signed in with now: sign in another way first. Agoo emails you whenever a way to sign in is added or removed, so you'd know if it wasn't you. An email code always works, so you can't lock yourself out by removing your password.
Accept an invitation with Google or Microsoft
When your organisation allows it, the invitation page offers Accept with Google and Accept with Microsoft beside setting a password. The account you choose must have the email address you were invited at. An Owner's invitation always asks for a password.
Your organisation's rules
Owners and Admins set them in Console → Settings → Security → Sign in with Google and Microsoft:
| Setting | What it does | Default |
|---|---|---|
| Google sign-in, Microsoft sign-in | Whether members may use each | On |
| Personal accounts | Whether Gmail and Outlook.com accounts may be used, as well as work ones | On |
| Google Workspace domains | Only Google accounts from these domains, such as voltabank.example | Any |
| Microsoft organisations | Only Microsoft work accounts from these organisations: sign in with Microsoft and choose Add the organisation I'm signed in to | Any |
| Require Google or Microsoft sign-in | Members must sign in with an account these rules allow; a password or an email code alone no longer opens the organisation | Off |
Someone in several organisations is affected only where the rules apply: if Volta Bank doesn't allow Google sign-in, signing in with Google still opens their other organisations, and the Console and the app tell them how to open Volta Bank, with a Continue with Microsoft button when that's what it asks for.
Choose who can sign in this way
Switch providers on or off, and add your domains or organisations if you want only work accounts. Save. Sign-ins that no longer meet the rules lose access at once.
Sign in with Google or Microsoft yourself
To require it, you must be signed in with an account the rules allow, so you can't lock yourself out.
Require it
Turn on Require Google or Microsoft sign-in, check how many members haven't signed in this way yet, and confirm with your authenticator's code. Every member is emailed.
The Owner always has a way in
However your rules are set, the Owner can always sign in with their password and authenticator, even when Google or Microsoft is down or your rules are wrong. So an Owner can't remove their password or authenticator, and nobody becomes an Owner without both. Agoo support sessions aren't affected.
Every plan includes these rules, Free too, so changing plan never changes how your people sign in. Agoo can't see when an employer suspends someone's Google or Microsoft account, so if you require it, consider shorter sign-ins, and remove leavers in People: that ends their access at once.
What Agoo receives
Only the account's name, its email address, Google's or Microsoft's confirmation that the email is the person's, and which Google Workspace domain or Microsoft organisation it belongs to. Never mail, contacts, files or calendars, and Agoo keeps no access to the account after sign-in. Calendars are separate: each person chooses to connect theirs. If your IT team approves apps before staff can use them, they approve Agoo once: see Google or Microsoft.
To stop signing in with Google or Microsoft, remove it in Sign-in methods (above). To remove Agoo from the Google or Microsoft account as well, use myaccount.google.com/connections, myaccount.microsoft.com (work or school) or account.live.com/consent/Manage (Outlook.com).
If it doesn't work
When Google or Microsoft doesn't open Agoo, the sign-in page says why. Your password or an email code always works meanwhile.
| What Agoo says | What to do |
|---|---|
| There's no Agoo account for (your email) yet | Ask your organisation's Owner or an Admin to invite you, or sign up to start a new organisation. |
| Google (or Microsoft) didn't confirm this email belongs to you | Sign in with your password or an email code, then add Google or Microsoft from Sign-in and security. |
| (Your organisation) doesn't allow Google (or Microsoft) sign-in | Your organisation has switched it off. Use your password or an email code, or ask an Owner or Admin. |
| (Your organisation) doesn't allow personal Google (or Microsoft) accounts | Choose your work account. |
| (Your organisation) only allows Google (or Microsoft) accounts from its own organisation | Choose your work account. |
| Your organisation's IT needs to approve Agoo in Google (or Microsoft) first | Your IT team approves Agoo once: Google, Microsoft. |
| This Google (or Microsoft) account is already used to sign in to another Agoo account | Sign in to that Agoo account and remove it there first, or choose another account. |
| This invitation is for (one address), but you chose (another) | Choose the account with the address you were invited at, or set a password. |
| That sign-in finished in a different browser from the one it started in | Start again in the browser you use for Agoo. |
| That took too long, or the sign-in was cancelled | Start again. |
| Google (or Microsoft) sign-in is paused for a few minutes | Use your password or an email code, or try again soon. The status page says more. |
SAML and SCIM (Pro and Enterprise, planned)
Not yet available
SAML single sign-on and SCIM provisioning are planned and not built yet, so there's nothing to set up today. This section says what they will do; the set-up steps come here when they're ready.
SAML will connect Agoo to your identity provider, such as Microsoft Entra ID, Okta or Google Workspace, so signing in to the Console and Agoo Workspace follows your own policies, including your multi-factor authentication. You'll be able to require it for everyone on email domains you've proved are yours, while the Owner keeps a password and an authenticator as a way back in.
SCIM will let your identity provider create, update and deactivate people in Agoo automatically, so you don't manage two directories: joiners appear in People, and leavers lose access.
Until then, Sign in with Google or Microsoft, with your rules for which accounts, works on every plan, and removing a leaver in People ends their access at once.
Roles still come from Agoo: SSO proves who someone is, and their role in Console → People decides what they can do. See Roles and permissions.
Account recovery
What happens when someone loses the phone with their authenticator app, how Owners and Admins approve a reset safely, and how an organisation gets a new Owner when its Owner has gone.
Branding
Put your logo, colours and welcome on the kiosk, passes, emails, booking pages and badges, and use your own domain.