For IT admins
Bring Hivenza in the way your company signs in
Two ways for your people to sign in with their work account. Approve Hivenza's Microsoft sign-in once for everyone, or connect your own identity provider so sign-in, access and leavers stay under your control.
Continue with Microsoft
Anyone can sign in with their Microsoft work or school account. Hivenza only asks Microsoft for their name and email address: no mail, files or calendar.
- If your organisation lets employees approve apps, nothing to do: they click Continue with Microsoft and accept.
- If employees see "Need admin approval", an administrator approves Hivenza once for everyone, by signing in with Continue with Microsoft and ticking "Consent on behalf of your organization", or with the link below.
- Hivenza then shows in your Entra admin centre under Enterprise applications, where you can limit it to some people or remove it.
Admin approval link
https://login.microsoftonline.com/organizations/adminconsent?client_id=af181245-cffb-4124-b8e4-0acee0d683d7Microsoft labels the app "unverified" until Hivenza's publisher verification is complete. It changes how the prompt looks, not what the app can do: it can only read the name and email it asks for.
Your own single sign-on
On the Enterprise plan, Hivenza signs your people in through your identity provider. Set it up in Hivenza under Settings → Single sign-on (owners and admins).
- Microsoft Entra ID, Okta, Google Workspace, or any SAML 2.0 or OpenID Connect provider.
- Require it, and members can only open your workspace after signing in through your provider.
- New people join on their first sign-in, with the role and brands you choose.
- SCIM provisioning adds, updates and removes people from your directory.
Setting up single sign-on
Prove your company's domain
In Settings → Single sign-on, add your email domain (yourcompany.com). Hivenza shows a TXT record starting with hivenza-verification=. Add it to your domain's DNS, then click Check now. Only addresses on proven domains can sign in this way.
Add Hivenza to your identity provider
For Microsoft Entra ID, Okta or another OpenID Connect provider: register a web application with this redirect address, and copy its client ID and a client secret. For SAML: choose SAML in Hivenza first, and it shows the Entity ID and the reply (ACS) address to enter.
Redirect address (OpenID Connect)
https://hivenza.com/api/auth/sso/callbackEnter the details in Hivenza
Pick your provider, then paste the directory (tenant), client ID and secret, or your SAML metadata. Click Try the sign-in: it signs you in once through your provider without changing anything for anyone else.
Turn it on, and require it if you want
Once the test worked, turn single sign-on on. Choose whether new people join automatically, with which role and which brands. Require it, and every member except the owners has to sign in through your provider to open the workspace, so owners can never be locked out.
Provision people with SCIM (optional)
Make a token in Hivenza, then add SCIM provisioning in your identity provider with this address and the token. People you assign get an account; people you remove lose access at once. Owners are never changed this way.
SCIM address
https://hivenza.com/api/scim/v2
Questions
Which plan includes single sign-on?
The Enterprise plan. Continue with Microsoft and Continue with Google work on every plan, the free one included.
What does Hivenza get from Microsoft with Continue with Microsoft?
Your name, your email address and an identifier for your account. It doesn't ask for and can't read mail, files, calendars, contacts or anything else in Microsoft 365.
Why does Microsoft say "unverified"?
Microsoft shows a verified badge once the publisher has completed Microsoft's publisher verification, which Hivenza is going through. Until then the label shows; the permissions are the same and your admin stays in control in Enterprise applications.
Can people still use a password?
To sign in to Hivenza, yes. But once you require single sign-on, members can only open your workspace after signing in through your provider; owners keep their usual sign-in so the workspace can't be locked.
What happens when someone leaves?
With SCIM, removing them in your directory ends their access in Hivenza at once. Without SCIM, an owner or admin removes them from the team in Hivenza; their sign-in through your provider stops working when you disable them there.