Single sign-on (SSO)

With single sign-on, your team signs in to backcrew through your company’s own identity provider, such as Microsoft Entra ID, Okta, Google Workspace, ADFS or Ping, instead of a backcrew password. backcrew supports SAML 2.0 and OpenID Connect.

Getting it set up

backcrew’s team sets SSO up for your workspace with you. Contact us, and have ready:

• Your identity provider’s details:
  • For SAML, its federation metadata URL, or the metadata XML.
  • For OpenID Connect, its issuer URL, and a client id and secret for backcrew.
• Your company’s email domains, for example acme.com.

We give you the values to register backcrew in your identity provider (its sign-in address and identifier).

Prove you own your domains

For each domain, we give you a DNS TXT record to add, like:

Name	Value
_backcrew-verification.acme.com	backcrew-verification=…

Once the record is in your DNS, we check it. A domain only takes part in SSO after this check, so nobody else can claim it. Public email domains, such as gmail.com, can’t be used.

Signing in

On backcrew’s sign-in page, people enter their work email. If its domain is one of yours, they go to your company’s sign-in page, and come back to backcrew signed in.

• The first time, they join your workspace with the role agreed at setup: viewer unless you asked for another. An owner can change their role on the Members page like anyone else’s.
• If they already had a backcrew account with the same email, signing in through SSO uses that same account: the same workspaces, roles and history.
• Only once: if an owner removes someone from the workspace, signing in again through SSO doesn’t add them back. An owner can invite them again.
• Passwords: people who sign in through SSO have no backcrew password. Settings says their password is managed by your company.

Require SSO

Once at least one domain is verified, we can make SSO required for your workspace. People whose email is in your verified domains can then only use the workspace by signing in through your company. If they sign in with a backcrew password, the workspace tells them to sign in with their work email instead. Their other workspaces, if any, aren’t affected.

People outside your domains, such as a contractor or backcrew’s support team, keep signing in as before. So an outage at your identity provider can’t lock every owner out.

Automatic provisioning (SCIM)

Your identity provider can add and remove people for you, over SCIM 2.0 (users only). We give you a SCIM base URL and a token to enter in your identity provider’s provisioning settings, for example Entra ID’s Provisioning or Okta’s Provisioning tab. The token is shown only once; we can make a new one at any time, which stops the old one.

• Assigning someone to backcrew in your identity provider adds them. If they already have a backcrew account they join the workspace at once; otherwise they join at their first sign-in.
• Removing or deactivating someone takes them out of the workspace at once, even if they’re signed in. They don’t join again while they’re deactivated.
• Groups aren’t provisioned: roles are set in backcrew, on the Members page.

People who leave

With SCIM, deactivating them in your identity provider removes them from the workspace at once.

Without SCIM, turning their account off in your identity provider stops them signing in again. But a backcrew session they already have open keeps working until it expires, which can take up to 30 days. To cut their access at once, an owner also removes them on the Members page.

Turning SSO off

Ask us to remove it. Sign-ins through your identity provider stop at once.

• People who also had a backcrew password keep signing in with it, with the same workspaces and roles.
• People who only ever signed in through SSO have no backcrew password. An owner invites them again, and they sign up with a password.