Sign in to one of your organization's applications (single sign-on)

Your organization's applications (internal portals, Microsoft 365, cloud applications) can send you to the authentication service to confirm who you are. After the first confirmation, single sign-on lets you into other applications without repeating it.

What does the sign-in look like?

1. The application sends you to the sign-in page. The page shows «Sign in to HR Portal» (the application's name) with the organization already filled in.
2. Confirm with your passkey. If you have one, you can also choose «Approve on phone»: «Continue with your passkey or approve this sign-in on your phone.»
3. For some services, the page shows «Continue to the service» with the «Service», the «Registered destination» and the «Permissions». Check them and choose «Continue». «Cancel» refuses the sign-in.
4. You return to the application, signed in.

What is single sign-on?

After you sign in with a passkey or your phone, the browser keeps a single sign-on session. When you open another of your organization's applications, the page shows «Continue as ana@example.com», «Use another account» and «Not you? Sign out».

Single sign-on:

• never lasts longer than the sign-in that opened it (at most eight hours, or less if your organization sets it);
• does not work for the administration console or for approving requests;
• does not open applications marked sensitive, which always ask for the passkey.

Why did the application ask for my passkey again?

If «The single sign-on session cannot be used for this sign-in. Confirm with your passkey.» appears, confirm with your passkey.

The phone refused the sign-in

If the phone or the page says the access policy does not allow phone approval for this service, use your passkey. The application requires a phishing-resistant assurance.

Signing out of an application

Signing out of the authentication service does not end the sessions the applications already created. Also use each application's sign-out button.