> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mymeddical.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Staff sign-in and SSO

> Choose how staff sign in — email and password, or Microsoft Entra / Google Workspace single sign-on — and change those settings step by step.

## Overview

mymeddiCAL supports **three** sign-in methods. They are not interchangeable.

| Who                                           | How they sign in                                                                    | Can you switch this?                 |
| --------------------------------------------- | ----------------------------------------------------------------------------------- | ------------------------------------ |
| **Staff** (nurses, teachers, office, coaches) | Email and **password**, or your organisation’s **SSO** (Microsoft / Google / Apple) | Yes — Super Admin, on Settings → SSO |
| **Parents / guardians**                       | Email **magic link** or a **6-digit code**. No password.                            | No — guardians never use school SSO  |
| **You (first Super Admin)**                   | The password you set at signup, until you turn on SSO for yourself too              | Same staff rules as above            |

This page is only about **staff**. Changing SSO does **not** change how parents sign in. See [Inviting a guardian](/staff/inviting-a-guardian) and [Accepting an invitation](/getting-started/accepting-invitation).

<Note>
  Only a **Super Admin** can open and save SSO Settings. Staff and nurse roles can use SSO to sign in once you have turned it on, but they cannot change the switches.
</Note>

***

## What you are choosing

Pick **one** staff model before you invite a large team. You can change later, but people can get locked out if you require SSO before Microsoft/Google actually works.

**A — Email and password (default)**\
Staff receive an invite, set a password, and sign in at `yourorg.mymeddical.com`. No school IT work. Use this unless the school already lives in Microsoft 365 / Google Workspace.

**B — Microsoft Entra ID (Azure AD) — typical for schools**\
Staff click **Continue with Microsoft** on your organisation login page and use their school Microsoft account (including MFA your IT already requires). Best when the school already uses Microsoft 365.

**C — Google Workspace**\
Same idea with **Continue with Google**, limited to your school’s Google domain.

You can offer Microsoft **and** Google at the same time. You can also leave password login on as a backup, or turn **Require SSO Only** so staff cannot use a password.

<Warning>
  **Require SSO Only** turns off password login for **staff**. Test Microsoft or Google sign-in yourself first. Do not turn this on until at least one Super Admin can sign in with SSO. Guardians are not affected.
</Warning>

***

## Before you start (Microsoft / Entra)

You need two people, or one person with both hats:

1. A mymeddiCAL **Super Admin** (this page).
2. A school **IT admin** who can open [Microsoft Entra admin center](https://entra.microsoft.com) (or Azure Portal) for the school’s directory.

Have these ready:

* Your organisation URL, e.g. `https://yourschool.mymeddical.com`
* The school’s **Entra tenant ID** (a GUID that looks like `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`) — steps below
* The work emails staff already use for Microsoft 365 (you will add the same emails in mymeddiCAL)

<Tip>
  Independent and Catholic schools usually have **their own** Entra tenant. Government schools often sit in a **department-wide** tenant (many schools, one directory). If that is you, tenant ID alone is not enough — you must restrict who can use the app in Entra (assignment required + a group) and set **Allowed Email Domains** in mymeddiCAL. See [Government / shared directories](#government--shared-directories).
</Tip>

***

## Open SSO Settings

1. Sign in to your organisation portal as **Super Admin** (e.g. `https://yourschool.mymeddical.com`).
2. In the left sidebar, click **Settings**.
3. Scroll to the card titled **Single Sign-On (SSO) Settings**.
4. You should see an info banner: *Super Admin Settings* — *Configure SSO to allow users to sign in with social accounts. Changes take effect immediately after saving.*

If you do not see that card, you are not signed in as Super Admin. Ask the organisation owner to do these steps, or to raise your role.

Nothing is live until you click **Save SSO Settings** at the bottom of the card.

***

## Keep password login (do nothing extra)

New organisations already use password login. You do **not** need SSO Settings for that.

To add staff on password login:

1. Follow [Inviting staff](/admin/inviting-staff) — Add Staff, then **Send Invite**.
2. They set a password from the email (see [Accepting an invitation](/getting-started/accepting-invitation)).
3. They sign in at your organisation URL with email and password.

Leave **Enable SSO** off. Status at the bottom of the card should read **SSO Disabled**.

***

## Turn on Microsoft / Entra (step by step)

Do these in order. Do **not** turn on **Require SSO Only** until step 8 works.

### Step 1 — Find your Entra tenant ID (school IT)

1. Open [https://entra.microsoft.com](https://entra.microsoft.com) and sign in as a school IT admin.\
   Alternative: [Azure Portal](https://portal.azure.com) → **Microsoft Entra ID**.
2. Open **Identity** → **Overview** (Entra) or **Microsoft Entra ID** → **Overview** (Azure).
3. Copy **Tenant ID**. It is a GUID, not the school’s web domain, and not your email.

### Step 2 — Enable SSO in mymeddiCAL (Super Admin)

1. Open **Settings** → **Single Sign-On (SSO) Settings**.
2. Switch **Enable SSO** **on**. Extra options appear.
3. Leave **Require SSO Only** **off** for now (password still works as a backup).
4. Under **Providers**, switch **Microsoft** **on**.
5. In **Limit sign-in to a specific Microsoft / Azure AD tenant**, paste the Tenant ID from step 1.\
   Do **not** leave this empty for a school — empty means any Microsoft account (including personal Hotmail/Outlook) could try to sign in.
6. Optional but recommended: in **Allowed Email Domains**, type your school domains, comma-separated, with no `@`. Example: `yourschool.vic.edu.au, yourschool.edu.au`
7. Leave **Auto-create Staff Accounts** **off** unless you have read [Auto-create staff](#auto-create-staff-leave-this-off-unless-you-mean-it) and still want it.
8. Click **Save SSO Settings**.
9. Confirm the status tags show **SSO Enabled** (and not yet **Password Login Disabled**).

### Step 3 — Restrict who can use the app in Entra (school IT)

mymeddiCAL appears in your directory as an **enterprise application** after the first successful consent / sign-in. If it is not there yet, complete Super Admin test sign-in in step 4 first, then return here.

1. In Entra admin center go to **Identity** → **Applications** → **Enterprise applications**.
2. Open the **mymeddiCAL** application (search if the list is long).
3. Open **Properties**.
4. Set **Assignment required?** to **Yes**. Save.
5. Open **Users and groups**.
6. **Add user/group**. Choose a security group such as `mymeddiCAL staff` that contains only the people who should use the product (nurse, office, first-aid officers — not every teacher mailbox).
7. If a **Permissions** / **Grant admin consent** prompt appears for Microsoft Graph (`openid`, `profile`, `email`, `User.Read`), grant **admin consent** for the organisation.

<Warning>
  If **Assignment required** is **No** (or you never set it) and you are on a department-wide tenant, staff from **other schools** in the same directory may be able to reach the Microsoft button on *your* mymeddiCAL URL. Always use assignment required plus a group.
</Warning>

### Step 4 — Test as Super Admin

1. Sign **out** of mymeddiCAL (or use a private browser window).
2. Go to `https://yourschool.mymeddical.com`.
3. You should see **Continue with Microsoft** as well as email/password.
4. Click **Continue with Microsoft**.
5. Sign in with the **same work email** as your mymeddiCAL Super Admin account.
6. Complete MFA if Entra asks.
7. You should land on the dashboard. That email is now linked to Microsoft for this organisation.

If Microsoft sign-in fails, **do not** turn on Require SSO Only. Use password login, and see [Troubleshooting](#troubleshooting).

### Step 5 — Add staff with matching emails

1. Go to **Staff & Users** → **+ Add Staff**.
2. Use each person’s **Microsoft 365 email** — it must match exactly (including spelling).
3. Choose their **role**. Save.

If **Require SSO Only** is still off, you may also [send a password invite](/admin/inviting-staff) as a backup. If you plan to require SSO, you can skip the invite email and tell them to use the login URL instead.

### Step 6 — Tell staff how to sign in

Send them:

1. Your organisation URL: `https://yourschool.mymeddical.com`
2. Click **Continue with Microsoft**
3. Use their school Microsoft account (the same email you entered under Staff)

They do **not** use a parent/guardian code. That tab is only for families.

### Step 7 — Optional: link an existing password account

Staff who already have a password can keep it until you require SSO. After they click **Continue with Microsoft** once with the **same email**, Settings → **Linked Accounts** will show Microsoft connected. They do not need a second mymeddiCAL user.

### Step 8 — Optional: require SSO only (turn passwords off for staff)

Only after **you** can sign in with Microsoft:

1. Settings → **SSO Settings**.
2. Switch **Require SSO Only** **on**. The helper text reads: *Disable password login — users must use SSO to sign in.*
3. **Save SSO Settings**.
4. Status should show **SSO Enabled** and **Password Login Disabled**.

From this point:

* Staff sign in with Microsoft (or another provider you left on).
* The add-staff screen tells you **no invite email is needed** — share the login URL instead.
* Password login is off **for staff only**. Guardians still use email codes.

***

## Turn on Google Workspace (step by step)

1. Settings → **SSO Settings** → switch **Enable SSO** **on**.
2. Under **Providers**, switch **Google** **on**.
3. In **Limit sign-in to a specific Google Workspace domain**, enter the domain **without** `@` (e.g. `yourschool.vic.edu.au`).\
   If this is empty, **any** Google account could be used — do not leave it empty for a school.
4. Optional: set **Allowed Email Domains** the same way as for Microsoft.
5. Leave **Auto-create Staff Accounts** off unless you intend it.
6. **Save SSO Settings**.
7. Sign out, open your organisation URL, click **Continue with Google**, and sign in with a school Google account that already exists as a staff user (same email).
8. Restrict the Google Cloud / Workspace app to your organisational unit if your IT requires it (that work is in Google Admin, not in mymeddiCAL).

You can run Google and Microsoft together. Staff use whichever button matches their directory.

***

## Apple

The **Apple** switch allows **Continue with Apple** on the staff login page. There is no school-domain box for Apple on this screen — if you enable it, also set **Allowed Email Domains** so random Apple IDs cannot be used. Most Australian schools should leave Apple **off** and use Microsoft or Google.

***

## Auto-create staff (leave this off unless you mean it)

**Auto-create Staff Accounts** creates a new staff user on **first successful SSO login** if that email is not already in your organisation.

Leave it **off** for almost every school. If it is on, and Microsoft tenant ID / Google domain / allowed domains are too loose, people you never invited can appear as staff.

If you turn it on:

* Still add **Microsoft tenant ID** or **Google hosted domain**, and **Allowed Email Domains**.
* Still use Entra **Assignment required**.
* Know that new users get the default staff role configured for SSO (typically **Staff**) — not Super Admin. You must change roles afterwards in Staff & Users.

***

## Government / shared directories

If your Microsoft tenant is shared across many schools:

1. Always paste the **tenant ID** (step 1 of Microsoft setup).
2. Always set **Allowed Email Domains** to **this school only**.
3. Always set Entra **Assignment required = Yes** and assign a **group that only contains this school’s staff**.
4. Keep **Auto-create Staff Accounts** **off**.
5. Prefer **invite-then-SSO** (add each staff email yourself) over auto-create.

Tenant ID without a group is not a school boundary in a shared directory.

***

## Adding staff after SSO is on

| SSO setting                 | What you do in mymeddiCAL                                                                                    | What the staff member does                     |
| --------------------------- | ------------------------------------------------------------------------------------------------------------ | ---------------------------------------------- |
| SSO off                     | [Invite staff](/admin/inviting-staff) — they set a password                                                  | Email + password at your URL                   |
| SSO on, Require SSO **off** | Add them with their work email. You may still Send Invite for a password backup                              | Password **or** Continue with Microsoft/Google |
| Require SSO **on**          | Add them with their work email. **Do not rely on a password invite.** Share `https://yourorg.mymeddical.com` | Continue with Microsoft/Google only            |

Use the **same email** as Entra or Google. A personal Gmail next to a school Microsoft account will not match.

***

## Switch back to password login

1. Settings → **SSO Settings**.
2. Switch **Require SSO Only** **off** first (passwords become available again). **Save**.
3. If you want SSO gone entirely, switch **Enable SSO** **off**. **Save**. Status should read **SSO Disabled**.
4. Staff who never had a password need a [new invitation](/admin/inviting-staff) or a password reset so they can sign in with email and password.

Do not disable Microsoft/Google while Require SSO Only is still on — staff would have no way to sign in.

***

## What this never does

* It does **not** put parents into Entra or Google. Families keep [magic link / email code](/getting-started/accepting-invitation).
* It does **not** change a staff member’s **role** (Nurse vs Admin). You still set that under Staff & Users.
* It does **not** sign people out of Entra when you remove them from mymeddiCAL. Remove them from the Entra group **and** deactivate them in Staff & Users.
* mymeddiCAL sessions can last up to about 24 hours after you remove someone. Entra MFA and Conditional Access still apply at the Microsoft button on the next login.

***

## Troubleshooting

**I don’t see Continue with Microsoft**\
Enable SSO, enable the Microsoft provider, Save. Hard-refresh the login page. Confirm you are on `yourorg.mymeddical.com`, not the generic marketing site.

**Microsoft works for me but not for a colleague**\
Their Staff & Users email must match their Microsoft email. They must be in the Entra group if assignment is required. Wait a few minutes after group changes.

**“User not found and auto-provisioning is not enabled”**\
They are not a staff member in this organisation yet (and auto-create is off). Add them under Staff & Users first.

**I turned on Require SSO Only and I’m locked out**\
You still need a Super Admin who can use Microsoft, or contact [support@mymeddical.com](mailto:support@mymeddical.com) to turn Require SSO Only off. Test SSO before requiring it.

**Parents ask for the Microsoft button**\
They should use the **Parent / Guardian** path and the email code, not staff SSO. See [Accepting an invitation](/getting-started/accepting-invitation).

**Department IT asks if they must register their own app**\
Not for this setup. You use mymeddiCAL’s Microsoft sign-in, locked to **your tenant ID**. School IT consents and assigns users. Registering a separate school-owned app is not required for this flow.

***

## Related guides

* [Inviting staff](/admin/inviting-staff)
* [Organisation settings](/admin/organisation-setup)
* [Accepting an invitation](/getting-started/accepting-invitation)
* [Creating your organisation](/getting-started/creating-your-organisation)