Confirm availability
Self-service setup is in controlled rollout. Confirm your organization is enabled before scheduling a change.
For IT administrators and security reviewers
Microsoft sign-in. Access your team controls.
Let approved employees use their Microsoft work accounts. Connect each identity to the right Evidize user, then control access with organization permissions and product roles.
Free 30-minute Teams demo. Use our example or bring your workflow.
Self-service SSO setup is in controlled rollout. Confirm availability for your organization.
See the setup behind approved access.
Product walkthroughChoose a view to see what your team can do and what carries into the next step.
Start with the intended Microsoft tenant.
Workflow illustration
-
Evidize administrator
Open Microsoft sign-in setup
Start from Team & access and confirm which Microsoft tenant your organization will use.
-
Microsoft administrator
Verify the tenant and review consent
Use a supported tenant-administrator account to verify the tenant and review identity-only consent.
-
Evidize administrator
Review the connection details
Confirm the intended tenant before linking approved members. Outlook and mailbox permissions are configured separately.
An Evidize organization administrator starts setup. A supported Microsoft administrator verifies the tenant and reviews the identity-only consent.
What you work with
- Organization administrator access
- Microsoft tenant verification
- Identity-only consent
What carries forward
A verified sign-in connection
Complete the tenant and consent checks before activating access. Outlook and mailbox permissions are configured separately.
Connect the right identity to the right person.
Workflow illustration
-
Evidize administrator
Review the existing member
Confirm the person has an active Evidize account and the product role they need.
-
Evidize administrator
Link the intended Microsoft identity
Select the known Microsoft account or verify its Object ID in the connected tenant. Matching email text alone does not establish a binding.
-
Pilot users
Test before requiring SSO
Complete the administrator sign-in test before activation, then pilot an approved standard user and confirm the recovery route before requiring SSO.
Review approved members and link their Microsoft identity. The Tenant ID and user Object ID identify the account; a matching email address is not enough.
What you work with
- Existing Evidize member
- Explicit Microsoft identity mapping
- Administrator sign-in pilot
What carries forward
An identity your team has checked
Test the linked administrator and an approved standard user before requiring SSO. Provisioning is configured separately from sign-in.
Review each member’s product access.
Review Amelia Parker’s Standard User role, enabled account and organization-default candidate-page preferences before saving changes.
Open a member’s role and access settings to review their product role, enabled status and candidate-page preferences. Microsoft authentication does not assign product administrator access.
What you work with
- Assigned product role
- Enabled account
- Organization-default preferences
What carries forward
Access appropriate to each role
Review roles when responsibilities change. For offboarding, deactivate Evidize access and remove or disable Microsoft access.
Two systems, clear responsibilities
One work identity. The right product access.
-
Microsoft Entra
Authenticate
Your configured Microsoft policies verify the work account.
-
Evidize
Check permissions
Validate the linked user, organization, role and active access.
-
Hiring workspace
Open authorized records
Keep the available workspace within that person’s permissions.
Rollout readiness
Know who owns each step.
Plan the pilot with your IT and Evidize administrators before changing how employees sign in.
Identify both administrators
Bring an active Evidize organization administrator and a supported Microsoft tenant administrator. They can be different people.
Pilot before enforcement
Test the linked administrator and an approved standard user. Verify the intended tenant, user mappings and product roles.
Arrange recovery
Keep a working sign-in method during the pilot and agree an owner-verified recovery contact before requiring SSO.
One Microsoft tenant per Evidize organization, and one Evidize organization per tenant in each environment. Personal Microsoft accounts are not supported. Provisioning is configured separately from employee SSO.
For your technical review
Which system controls what?
Microsoft verifies the work identity. Evidize controls access to the organization and its product records.
| Control | Microsoft Entra | Evidize |
|---|---|---|
| Sign-in | Authenticates the work account. Microsoft passwords remain with Microsoft. | Checks the returned identity, approved organization and explicit user binding. |
| MFA and access policies | Applies MFA, Conditional Access and application assignment where licensed, configured and assigned. | Applies its own account, organization, role and session checks. |
| Product permissions | Microsoft administrator status does not grant an Evidize administrator role. | Organization administrators approve members and assign Evidize roles; provisioning is configured separately. |
| Integration access | Employee SSO consent covers identity information. | Outlook scheduling, mailbox access and candidate check-in have separate setup and access boundaries. |
Sign-in
- Microsoft Entra
- Authenticates the work account. Microsoft passwords remain with Microsoft.
- Evidize
- Checks the returned identity, approved organization and explicit user binding.
MFA and access policies
- Microsoft Entra
- Applies MFA, Conditional Access and application assignment where licensed, configured and assigned.
- Evidize
- Applies its own account, organization, role and session checks.
Product permissions
- Microsoft Entra
- Microsoft administrator status does not grant an Evidize administrator role.
- Evidize
- Organization administrators approve members and assign Evidize roles; provisioning is configured separately.
Integration access
- Microsoft Entra
- Employee SSO consent covers identity information.
- Evidize
- Outlook scheduling, mailbox access and candidate check-in have separate setup and access boundaries.
Before you get started
Make it work for your team.
See the setup, responsibilities and plan requirements before you decide.
Compare plans and capabilitiesCan we require Microsoft sign-in?
Yes, where SSO setup is enabled for your organization. You can retain permitted password access alongside Microsoft SSO or require SSO after a successful administrator pilot. Confirm availability, member mappings and a recovery contact before enforcement. Review the pilot steps
Does Microsoft consent create accounts or assign roles?
No. SSO consent alone does not create Evidize users, link identities or assign product roles. Provisioning, including available SCIM controls, is configured separately. Approved users need an active Evidize account, an appropriate product role and an explicit Microsoft identity binding before they can sign in.
Where do we manage MFA and Conditional Access?
Your Microsoft administrators manage those policies in Microsoft Entra, where licensed, configured and assigned. Evidize uses the resulting Microsoft authentication and applies its own user, organization, role and session checks. Local MFA indicators in the team directory are separate from Microsoft MFA policy.
What changes when someone joins, changes roles or leaves?
For a new member, provision the account, assign its Evidize role and check the Microsoft identity binding. Review product permissions when responsibilities change; a Microsoft administrator role does not confer an Evidize role. For offboarding, deactivate the Evidize user and remove or disable Microsoft access.
Does Microsoft revocation immediately end every Evidize session?
Microsoft and Evidize have separate session lifetimes. Revoking a Microsoft session or changing Microsoft policy does not necessarily end an already-issued Evidize session immediately. Deactivate the user in Evidize as well; a request already in progress may complete before revocation takes effect.
Does employee SSO grant mailbox or candidate access?
Employee sign-in uses identity information. It does not grant mailbox access. Outlook appointment setup is a separate integration, and candidate check-in is a separate journey. Evidize permissions determine which hiring records an employee can open. Review Microsoft and candidate privacy
See it with your team
Make the access plan clear before rollout.
Walk through Microsoft sign-in, identity linking and product roles with your technical team. Bring your requirements if useful; a prepared example is available.
Book a technical walkthroughFree 30-minute Teams demo. Use our example or bring your workflow.