Single Sign-On
TapPass Cloud (app.tappass.ai) supports Single Sign-On, so your team logs in with the identity they already have — no separate TapPass password. TapPass is registered as a single, multi-tenant application in your identity provider. You do not create an app registration or configure client secrets; you grant the TapPass application access to your organization one time.
Choose your provider
Section titled “Choose your provider”- Microsoft (Entra ID) — grant admin consent to the TapPass application in your Entra tenant.
- Google Workspace — mark the TapPass application as Trusted in your Google Admin console.
Do I even need an admin step?
Section titled “Do I even need an admin step?”Only if your organization restricts new third-party applications — a common enterprise policy:
- Microsoft — if your tenant disables user consent, a Global Administrator grants admin consent once.
- Google — if your Workspace restricts unconfigured third-party apps, an administrator marks the TapPass OAuth client Trusted once.
If your organization permits user consent (the default for many tenants), your users can sign in with no administrator action — TapPass only requests basic sign-in claims (openid, profile, email), which are user-consentable.
What TapPass reads
Section titled “What TapPass reads”| Claim | Purpose |
|---|---|
openid |
Sign the user in via OpenID Connect. |
profile |
The user’s name, to display in TapPass. |
email |
The user’s verified work email — how TapPass maps the user to your organization. |
TapPass reads these claims once at login. It does not request access to mailboxes, files, calendars, or your directory.
Self-hosted TapPass?
Section titled “Self-hosted TapPass?”This section covers TapPass Cloud. If you run TapPass on-premise and register your own identity-provider application, see the self-hosted federation guides under Integrations → Identity / SSO (Azure AD, Google Workspace, Okta, SAML 2.0, SPIFFE/SPIRE).