Single sign-on

Every Sencai user can sign in with a Google or Microsoft account today, with no setup required - the Continue with Google / Continue with Microsoft buttons on the sign-in page work for anyone. Organizations on the Business tier and above can go further: connect your Microsoft 365 tenant or Google Workspace domain, and require that every member of your organization sign in through it instead of a password.

Note

SSO and enforcement are Business-tier-and-above features. See Billing & plans for tier details.

Microsoft Entra ID

Connecting Entra ID is an admin consent flow - a Microsoft 365 Global Administrator (or an equivalent role) authorizes Sencai to read directory and license data from your tenant. It does not change how members sign in: the “Continue with Microsoft” button stays the same generic sign-in option for everyone. What it does is give your directory data (users, licenses) to Sencai for sync, and it’s the mechanism that unlocks SSO enforcement for Microsoft-authenticated organizations (see below).

1. Go to Settings → Integrations → MS365 Integration (/gravity/settings/integrations/ms365).
2. Enter your Azure Tenant ID (a GUID - find it in the Azure Portal under Microsoft Entra ID → Overview) and save it.
3. Select Grant Admin Consent. This opens Microsoft’s own consent page in a new window, showing exactly which permissions are being requested and by which application.
4. Sign in as a Global Administrator and approve the request.
5. You’re redirected back to this same page. Sencai automatically checks whether consent was recorded; if the status doesn’t update within a moment, select I’ve granted consent - verify.

Permissions requested and why

The consent screen requests three Microsoft Graph application permissions - read-only, no write scopes:

Permission	Used for
Organization.Read.All	Reading your tenant’s license SKUs (counts, types)
User.Read.All	Reading the user list and each user’s assigned licenses
AuditLog.Read.All	Reading directory audit activity for the identity watchdog

Reading Microsoft 365 group membership is not included in this consent grant, so group data does not sync - see Workspace directory for what does.

Caution

Consenting to a set of permissions only covers those permissions. If Sencai adds a new permission to this integration in the future (for example, to support group sync), your organization’s existing consent does not automatically extend to it - your administrator will need to grant consent again for the expanded request.

Because this is a multitenant application that hasn’t completed Microsoft’s publisher verification process yet, your administrator may see an “unverified publisher” warning on the consent screen. The requested permissions are read-only regardless of that warning; some Entra tenant policies block unverified multitenant apps outright, in which case your administrator will need to allow it explicitly before consent can succeed.

After consenting

Once consent is granted, the page shows a sync overview - license types, assigned/available seat counts, and the last sync timestamp. There’s no separate “test login” step here, because this integration doesn’t change how anyone signs in; use Refresh to confirm the connection is live.

Common issues:

• “Admin Consent not granted” after approving in Microsoft - select I’ve granted consent - verify manually; the automatic check can miss the redirect in some browsers.
• Consent screen shows “unverified publisher” - expected until Microsoft’s publisher verification completes; proceed if your tenant policy allows unverified apps, or ask your Microsoft 365 administrator to allow it.
• Sync overview is empty right after consenting - the first sync runs automatically; if it doesn’t appear, select Refresh.

Google Workspace

Connecting Google Workspace uses Domain-Wide Delegation - a service account you create in Google Cloud, authorized in your Google Admin Console to impersonate a real administrator for read-only Directory API calls. Unlike the Microsoft flow, there’s no consent screen inside the Sencai app itself; the authorization step happens entirely in your Google Admin Console.

1. Go to Settings → Integrations → Google Workspace Sync (/gravity/settings/integrations/google-workspace).
2. Instructions step: in Google Cloud Console, create (or reuse) a project and a service account (for example sencai-workspace-sync), then create and download a JSON key for it.
3. In your Google Admin Console, go to Security → API Controls → Domain-wide Delegation → Add new. Enter the service account’s numeric Client ID and the OAuth scopes shown on the Sencai wizard page (copy them with the provided button).
4. Back in Sencai, upload or paste the downloaded JSON key, along with your Workspace domain and (optional) Customer ID.
5. Enter the email address of a real domain administrator to impersonate - never the service account’s own email address; Domain-Wide Delegation requires a genuine admin account.
6. Select Test Sync to confirm the connection and see the number of users and groups found.

Permissions requested and why

The scopes you authorize in the Google Admin Console are all read-only:

Scope	Used for
admin.directory.user.readonly	Reading the user directory
admin.directory.group.readonly	Reading groups and membership
admin.directory.customer.readonly	Resolving your Workspace customer account
apps.licensing	Reading assigned Google Workspace license data

Because these are granted per Client ID in your own Admin Console (not through an OAuth consent redirect), there’s no separate “grant consent” step to repeat if Sencai needs an additional scope later - your administrator would authorize the new scope for the same Client ID.

Testing and troubleshooting

Test Sync is the way to confirm the connection works - it reports the counts of users and groups found, or the exact error if something is misconfigured:

• Test Sync fails with an authorization error - the most common cause is impersonating the service account’s own email instead of a real administrator’s email, or the Client ID entered in the Google Admin Console not matching the uploaded key’s service account.
• Service Account JSON is rejected - the file must be the complete, unmodified key file; Sencai checks for the required client_email and private_key fields before saving.
• The uploaded key is encrypted immediately and never shown again after saving - uploading a new file replaces it.

Requiring SSO for your organization

Once at least one method above is connected, an Owner or Admin can require that every member sign in exclusively through it, from Settings → Integrations → SSO Enforcement (/gravity/settings/integrations/sso-enforcement).

Enforcement is checked on the server before any password-based sign-in is attempted, so it can’t be bypassed from the browser.

Caution

An organization must have at least one working sign-in path before you turn this on. For Microsoft, completing admin consent above is sufficient. For Google Workspace, your organization’s verified domain needs to be registered separately - as of this writing that isn’t a self-service field in Settings, so contact your account team to have it set if the toggle reports Google Workspace as “not configured” even after completing the Directory Sync wizard.

Before you turn this on:

• Make sure the Owner account (and at least one Admin) can genuinely sign in through the connected identity provider - there is no built-in emergency password fallback once enforcement is active.
• Confirm every member has a corresponding account with your identity provider, or they’ll be locked out at their next sign-in attempt.

A pending, unaccepted invitation does not count as membership for enforcement purposes - someone who was invited but hasn’t accepted yet can still complete that invitation with a password sign-in even if the organization enforces SSO, since they aren’t a member of the organization until they accept. Enforcement only ever applies to people who are already members.

What’s next

• SCIM provisioning - automate adding and removing users
• Workspace directory - what data syncs and how often
• Account security - two-factor authentication for individual accounts
• Roles & permissions