Allow-list or single sign-on

The simplest option, and the one most pilots start with. Send us the email addresses or domains that may join, such as *@acme.com. People sign in with their Microsoft, Google or GitHub work account, and anyone outside the list is turned away. There is nothing to configure in your identity provider.

• Microsoft Entra ID: add OneTaskList to your tenant and an administrator consents once.
• Any OpenID Connect provider, such as Okta, Google Workspace or Keycloak: send us a client ID and secret and we will send you the redirect URI.
• Multi-factor authentication, conditional access and device rules stay with your identity provider. OneTaskList enforces whatever it tells us.

With single sign-on, sessions end after 24 hours by default, and you can set any length up to a week. Signing out ends the session straight away.

• SAML. OpenID Connect only.
• SCIM. People get a seat the first time they sign in, and you remove them in OneTaskList. Disabling someone in your identity provider also stops them signing in again.
• A custom domain for your region.

You can start on an allow-list and add single sign-on later. People keep their boards, tasks and connections. Anyone who already had a personal OneTaskList account confirms before it is linked to your organisation, so nobody is moved without knowing.