Sign in with Google, Microsoft, SSO or a passkey

Overview

Besides email and password, MetaLens360 can offer these sign-in options. Each one appears on the sign-in page only after the platform administrator has switched it on and its configuration has been checked, so you may see some, all or none of them:

• Continue with Google — Google Workspace (work) accounts.
• Continue with Microsoft — Microsoft work or school accounts (Entra ID).
• Sign in with a passkey — a passkey you added to your account (Face ID, Touch ID, Windows Hello, a phone or a security key).
• Single sign-on (SSO) — your company's own identity provider (Okta, Entra ID, Google Workspace, Auth0, OneLogin or any OpenID Connect provider), set up by your workspace Admin.

Email and password always stays available, last in the list.

MetaLens360 is for companies, so a workspace belongs to a company email domain. That shapes what happens the first time someone signs in. Existing accounts are never affected — they keep signing in as before, with any option whose verified email matches the account.

Who can create an account

Passkeys never create accounts: you add a passkey after you have signed in.

Steps

Sign in with Google or Microsoft

1. On the sign-in page, click Continue with Google or Continue with Microsoft.
2. Choose your work account at Google or Microsoft and approve.
3. You come back to MetaLens360 signed in. The page shows "Signing you in…" for a moment.

Sign in with single sign-on

1. Click Single sign-on (SSO).
2. Enter your Work email and click Continue.
3. Sign in at your company's identity provider. You come back signed in.

If you see "No single sign-on is set up for that email domain.", your workspace has not set up SSO — use another option.

Add a passkey to your account

1. Open Settings and choose Security & SSO (or go to /settings?tab=security).
2. Under Passkeys, click Add a passkey and give it a name, such as "Work laptop".
3. Confirm with your device (fingerprint, face, PIN or security key).
4. Next time, click Sign in with a passkey on the sign-in page.

You can rename or remove a passkey from the same list. Removing one only stops that passkey working; your other sign-in options are unaffected.

Verify your company's email domain (workspace Admins)

A verified domain stops anyone else creating a separate MetaLens360 workspace for your company, and is required for SSO. Colleagues still join by invitation.

1. Open Settings and choose Security & SSO. Under Workspace domains, click Add domain and enter your domain, for example initech.example.
2. Choose how to prove you own it:
   • DNS record — add the TXT record shown (host and value, each with a copy button) at your DNS provider, then click Check now. DNS changes can take a while to appear.
   • Email code — enter an address at that domain, send the code, and enter the 6-digit code from the email within 30 minutes.
3. The domain shows Verified. A domain can be verified by only one workspace.

Set up single sign-on for your workspace (workspace Admins)

1. Verify your domain first (above).
2. In your identity provider, create an OpenID Connect web application and register the Redirect URI shown under Workspace single sign-on (use the copy button).
3. In MetaLens360, click Add connection, choose the Domain, enter the Issuer URL, Client ID and Client secret, and pick the Default role for new people.
4. Click Test to check that MetaLens360 can reach your provider.

People from that domain who sign in with SSO for the first time are created in your workspace with the default role — never in another workspace. Admin is never given automatically. The client secret is stored encrypted and is never shown again; leave it blank when editing to keep it.

Switch sign-in options on (platform administrator)

Only the platform administrator sees this.

1. Open Settings → Security & SSO and scroll to Platform settings → Sign-in providers.
2. Each row shows its status: Ready, Needs configuration (with the missing items), or Disabled, plus the redirect URI to register with the provider.
3. When a row is ready, turn its switch on. The switch cannot be turned on while configuration is missing. Test configuration re-checks it now.
4. In Corporate sign-up policy, switch the policy on or off and edit the list of personal email domains (one per line; yahoo.* matches every Yahoo domain).

Every change is recorded in the platform audit log. Secrets are never displayed.

Example

Initech's Salesforce team lead, Dana, signs up with dana@initech.example and gets a new workspace. She verifies initech.example with a DNS record, then adds an SSO connection to Initech's Okta with the default role Developer. Her colleague signs in with Single sign-on (SSO) the next morning and lands straight in Initech's workspace. A contractor using a Gmail address is told to ask for an invitation; Dana invites them from Settings → Users.

FAQs

Can I use Google or Microsoft if my account was created with a password?

Yes. If the provider confirms the same email address, you are signed in to your existing account. Your password keeps working too.

Why don't I see Apple or ChatGPT?

MetaLens360 offers Google Workspace, Microsoft work accounts, passkeys, enterprise SSO and email. Apple and ChatGPT sign-in are not offered.

Are sign-ins recorded?

Yes. Every sign-in is recorded in the audit log with the method used, and refused sign-ins are recorded too. See Audit log and data security.

Troubleshooting

"We couldn't sign you in with that option" or "The sign-in took too long and expired"

The round trip to the provider failed, expired or was interrupted (for example, it was finished in another browser). Start again from the sign-in page.

"That account's email address is not verified with the provider"

The provider did not confirm the address as verified. For Microsoft, your organisation may need to verify its domain in Entra ID. Use another option or ask your Admin.

"There is no MetaLens account for this sign-in yet"

Passkeys only sign in existing accounts. Ask your company Admin to invite you, then add a passkey after you sign in.

"This workspace has been archived"

Your workspace was archived by the platform administrator. Every sign-in option is refused, exactly like a password sign-in. Contact support.

Related articles

• Sign in and reset your password
• Create a workspace
• Invite your team
• Roles and permissions