Skip to main content

​
Overview

mymeddiCAL supports three sign-in methods. They are not interchangeable. This page is only about staff. Changing SSO does not change how parents sign in. See Inviting a guardian and Accepting an invitation.
Only a Super Admin can open and save SSO Settings. Staff and nurse roles can use SSO to sign in once you have turned it on, but they cannot change the switches.

​
What you are choosing

Pick one staff model before you invite a large team. You can change later, but people can get locked out if you require SSO before Microsoft/Google actually works. A — Email and password (default)
Staff receive an invite, set a password, and sign in at yourorg.mymeddical.com. No school IT work. Use this unless the school already lives in Microsoft 365 / Google Workspace. B — Microsoft Entra ID (Azure AD) — typical for schools
Staff click Continue with Microsoft on your organisation login page and use their school Microsoft account (including MFA your IT already requires). Best when the school already uses Microsoft 365. C — Google Workspace
Same idea with Continue with Google, limited to your school’s Google domain. You can offer Microsoft and Google at the same time. You can also leave password login on as a backup, or turn Require SSO Only so staff cannot use a password.
Require SSO Only turns off password login for staff. Test Microsoft or Google sign-in yourself first. Do not turn this on until at least one Super Admin can sign in with SSO. Guardians are not affected.

​
Before you start (Microsoft / Entra)

You need two people, or one person with both hats:
  1. A mymeddiCAL Super Admin (this page).
  2. A school IT admin who can open Microsoft Entra admin center (or Azure Portal) for the school’s directory.
Have these ready:
  • Your organisation URL, e.g. https://yourschool.mymeddical.com
  • The school’s Entra tenant ID (a GUID that looks like xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) — steps below
  • The work emails staff already use for Microsoft 365 (you will add the same emails in mymeddiCAL)
Independent and Catholic schools usually have their own Entra tenant. Government schools often sit in a department-wide tenant (many schools, one directory). If that is you, tenant ID alone is not enough — you must restrict who can use the app in Entra (assignment required + a group) and set Allowed Email Domains in mymeddiCAL. See Government / shared directories.

​
Open SSO Settings

  1. Sign in to your organisation portal as Super Admin (e.g. https://yourschool.mymeddical.com).
  2. In the left sidebar, click Settings.
  3. Scroll to the card titled Single Sign-On (SSO) Settings.
  4. You should see an info banner: Super Admin Settings — Configure SSO to allow users to sign in with social accounts. Changes take effect immediately after saving.
If you do not see that card, you are not signed in as Super Admin. Ask the organisation owner to do these steps, or to raise your role. Nothing is live until you click Save SSO Settings at the bottom of the card.

​
Keep password login (do nothing extra)

New organisations already use password login. You do not need SSO Settings for that. To add staff on password login:
  1. Follow Inviting staff — Add Staff, then Send Invite.
  2. They set a password from the email (see Accepting an invitation).
  3. They sign in at your organisation URL with email and password.
Leave Enable SSO off. Status at the bottom of the card should read SSO Disabled.

​
Turn on Microsoft / Entra (step by step)

Do these in order. Do not turn on Require SSO Only until step 8 works.

​
Step 1 — Find your Entra tenant ID (school IT)

  1. Open https://entra.microsoft.com and sign in as a school IT admin.
    Alternative: Azure Portal → Microsoft Entra ID.
  2. Open Identity → Overview (Entra) or Microsoft Entra ID → Overview (Azure).
  3. Copy Tenant ID. It is a GUID, not the school’s web domain, and not your email.

​
Step 2 — Enable SSO in mymeddiCAL (Super Admin)

  1. Open Settings → Single Sign-On (SSO) Settings.
  2. Switch Enable SSO on. Extra options appear.
  3. Leave Require SSO Only off for now (password still works as a backup).
  4. Under Providers, switch Microsoft on.
  5. In Limit sign-in to a specific Microsoft / Azure AD tenant, paste the Tenant ID from step 1.
    Do not leave this empty for a school — empty means any Microsoft account (including personal Hotmail/Outlook) could try to sign in.
  6. Optional but recommended: in Allowed Email Domains, type your school domains, comma-separated, with no @. Example: yourschool.vic.edu.au, yourschool.edu.au
  7. Leave Auto-create Staff Accounts off unless you have read Auto-create staff and still want it.
  8. Click Save SSO Settings.
  9. Confirm the status tags show SSO Enabled (and not yet Password Login Disabled).

​
Step 3 — Restrict who can use the app in Entra (school IT)

mymeddiCAL appears in your directory as an enterprise application after the first successful consent / sign-in. If it is not there yet, complete Super Admin test sign-in in step 4 first, then return here.
  1. In Entra admin center go to Identity → Applications → Enterprise applications.
  2. Open the mymeddiCAL application (search if the list is long).
  3. Open Properties.
  4. Set Assignment required? to Yes. Save.
  5. Open Users and groups.
  6. Add user/group. Choose a security group such as mymeddiCAL staff that contains only the people who should use the product (nurse, office, first-aid officers — not every teacher mailbox).
  7. If a Permissions / Grant admin consent prompt appears for Microsoft Graph (openid, profile, email, User.Read), grant admin consent for the organisation.
If Assignment required is No (or you never set it) and you are on a department-wide tenant, staff from other schools in the same directory may be able to reach the Microsoft button on your mymeddiCAL URL. Always use assignment required plus a group.

​
Step 4 — Test as Super Admin

  1. Sign out of mymeddiCAL (or use a private browser window).
  2. Go to https://yourschool.mymeddical.com.
  3. You should see Continue with Microsoft as well as email/password.
  4. Click Continue with Microsoft.
  5. Sign in with the same work email as your mymeddiCAL Super Admin account.
  6. Complete MFA if Entra asks.
  7. You should land on the dashboard. That email is now linked to Microsoft for this organisation.
If Microsoft sign-in fails, do not turn on Require SSO Only. Use password login, and see Troubleshooting.

​
Step 5 — Add staff with matching emails

  1. Go to Staff & Users → + Add Staff.
  2. Use each person’s Microsoft 365 email — it must match exactly (including spelling).
  3. Choose their role. Save.
If Require SSO Only is still off, you may also send a password invite as a backup. If you plan to require SSO, you can skip the invite email and tell them to use the login URL instead.

​
Step 6 — Tell staff how to sign in

Send them:
  1. Your organisation URL: https://yourschool.mymeddical.com
  2. Click Continue with Microsoft
  3. Use their school Microsoft account (the same email you entered under Staff)
They do not use a parent/guardian code. That tab is only for families. Staff who already have a password can keep it until you require SSO. After they click Continue with Microsoft once with the same email, Settings → Linked Accounts will show Microsoft connected. They do not need a second mymeddiCAL user.

​
Step 8 — Optional: require SSO only (turn passwords off for staff)

Only after you can sign in with Microsoft:
  1. Settings → SSO Settings.
  2. Switch Require SSO Only on. The helper text reads: Disable password login — users must use SSO to sign in.
  3. Save SSO Settings.
  4. Status should show SSO Enabled and Password Login Disabled.
From this point:
  • Staff sign in with Microsoft (or another provider you left on).
  • The add-staff screen tells you no invite email is needed — share the login URL instead.
  • Password login is off for staff only. Guardians still use email codes.

​
Turn on Google Workspace (step by step)

  1. Settings → SSO Settings → switch Enable SSO on.
  2. Under Providers, switch Google on.
  3. In Limit sign-in to a specific Google Workspace domain, enter the domain without @ (e.g. yourschool.vic.edu.au).
    If this is empty, any Google account could be used — do not leave it empty for a school.
  4. Optional: set Allowed Email Domains the same way as for Microsoft.
  5. Leave Auto-create Staff Accounts off unless you intend it.
  6. Save SSO Settings.
  7. Sign out, open your organisation URL, click Continue with Google, and sign in with a school Google account that already exists as a staff user (same email).
  8. Restrict the Google Cloud / Workspace app to your organisational unit if your IT requires it (that work is in Google Admin, not in mymeddiCAL).
You can run Google and Microsoft together. Staff use whichever button matches their directory.

​
Apple

The Apple switch allows Continue with Apple on the staff login page. There is no school-domain box for Apple on this screen — if you enable it, also set Allowed Email Domains so random Apple IDs cannot be used. Most Australian schools should leave Apple off and use Microsoft or Google.

​
Auto-create staff (leave this off unless you mean it)

Auto-create Staff Accounts creates a new staff user on first successful SSO login if that email is not already in your organisation. Leave it off for almost every school. If it is on, and Microsoft tenant ID / Google domain / allowed domains are too loose, people you never invited can appear as staff. If you turn it on:
  • Still add Microsoft tenant ID or Google hosted domain, and Allowed Email Domains.
  • Still use Entra Assignment required.
  • Know that new users get the default staff role configured for SSO (typically Staff) — not Super Admin. You must change roles afterwards in Staff & Users.

​
Government / shared directories

If your Microsoft tenant is shared across many schools:
  1. Always paste the tenant ID (step 1 of Microsoft setup).
  2. Always set Allowed Email Domains to this school only.
  3. Always set Entra Assignment required = Yes and assign a group that only contains this school’s staff.
  4. Keep Auto-create Staff Accounts off.
  5. Prefer invite-then-SSO (add each staff email yourself) over auto-create.
Tenant ID without a group is not a school boundary in a shared directory.

​
Adding staff after SSO is on

Use the same email as Entra or Google. A personal Gmail next to a school Microsoft account will not match.

​
Switch back to password login

  1. Settings → SSO Settings.
  2. Switch Require SSO Only off first (passwords become available again). Save.
  3. If you want SSO gone entirely, switch Enable SSO off. Save. Status should read SSO Disabled.
  4. Staff who never had a password need a new invitation or a password reset so they can sign in with email and password.
Do not disable Microsoft/Google while Require SSO Only is still on — staff would have no way to sign in.

​
What this never does

  • It does not put parents into Entra or Google. Families keep magic link / email code.
  • It does not change a staff member’s role (Nurse vs Admin). You still set that under Staff & Users.
  • It does not sign people out of Entra when you remove them from mymeddiCAL. Remove them from the Entra group and deactivate them in Staff & Users.
  • mymeddiCAL sessions can last up to about 24 hours after you remove someone. Entra MFA and Conditional Access still apply at the Microsoft button on the next login.

​
Troubleshooting

I don’t see Continue with Microsoft
Enable SSO, enable the Microsoft provider, Save. Hard-refresh the login page. Confirm you are on yourorg.mymeddical.com, not the generic marketing site. Microsoft works for me but not for a colleague
Their Staff & Users email must match their Microsoft email. They must be in the Entra group if assignment is required. Wait a few minutes after group changes. “User not found and auto-provisioning is not enabled”
They are not a staff member in this organisation yet (and auto-create is off). Add them under Staff & Users first. I turned on Require SSO Only and I’m locked out
You still need a Super Admin who can use Microsoft, or contact support@mymeddical.com to turn Require SSO Only off. Test SSO before requiring it. Parents ask for the Microsoft button
They should use the Parent / Guardian path and the email code, not staff SSO. See Accepting an invitation. Department IT asks if they must register their own app
Not for this setup. You use mymeddiCAL’s Microsoft sign-in, locked to your tenant ID. School IT consents and assigns users. Registering a separate school-owned app is not required for this flow.