> ## Documentation Index
> Fetch the complete documentation index at: https://help-empuls.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Login methods

> Empuls supports email/password, Google, Microsoft, Slack, and SAML 2.0 SSO. Learn how to choose and configure the right login method for your organization.

Empuls gives administrators control over how employees sign in. You can require a single login method for the entire organization, or enable multiple options so users can choose. Single sign-on (SSO) is the most common choice for enterprise customers because it lets employees use their existing corporate credentials and allows IT to add or revoke access centrally without managing a separate password.

## Available login methods

Empuls supports five authentication options:

| Method            | Best for                                                                                  |
| ----------------- | ----------------------------------------------------------------------------------------- |
| Email / Password  | Organizations without an SSO provider                                                     |
| Google SSO        | Google Workspace customers                                                                |
| Microsoft SSO     | Microsoft 365 / Azure AD customers                                                        |
| Slack SSO         | Organizations using Slack as their primary workspace                                      |
| SAML 2.0 (Custom) | Any IdP that speaks SAML 2.0: Okta, OneLogin, Ping Identity, ADFS, Oracle IAM, and others |

## Configure authentication settings

All authentication settings are in one place: navigate to **Admin > User Access Settings > User Authentication**. From this page you can toggle each method on or off, test connections before enabling them for all users, and set a default login method.

<Note>
  You need Super Admin access in Empuls to change authentication settings. Involve your IT team before enabling or switching SSO, especially for SAML 2.0 providers.
</Note>

### Google SSO

Toggle on **Google** to allow employees to sign in with their Google Workspace account. Empuls uses Google's standard OAuth flow — no additional configuration on the Empuls side is required. Your employees must have an active Google account whose email matches their Empuls user record.

### Microsoft SSO

Toggle on **Microsoft** and click **Proceed**. You will be redirected to sign in with your Microsoft 365 credentials to authorize the connection. Once credentials are verified, Empuls displays an "SSO verification is successful" confirmation.

<Note>
  The built-in **Microsoft** toggle uses Microsoft's OAuth flow and is separate from the **Azure AD / SAML 2.0** custom login path. Use the Microsoft toggle for straightforward Microsoft 365 SSO. Use the Azure AD SAML route when you need attribute mappings, conditional access policies, or greater control over the federation trust.
</Note>

### Slack SSO

Toggle on **Slack** and click **Proceed**. Enter your Slack workspace URL, sign in with your Slack credentials, and approve the connection. Slack sends a verification code to your email to complete authentication. After verifying, Empuls confirms the integration is active.

### SAML 2.0 (Custom login methods)

If your identity provider is not listed above, select **Custom Login Methods** and click **Configure Now**. Empuls supports any IdP that implements the SAML 2.0 standard. The configuration requires exchanging metadata between Empuls (Service Provider) and your identity provider.

<CardGroup cols={2}>
  <Card title="Azure AD" icon="microsoft" href="/admin/user-authentication/azure-ad">
    Connect Empuls to Azure Active Directory using SAML 2.0 federation.
  </Card>

  <Card title="Okta SSO" icon="shield" href="/admin/user-authentication/okta-sso">
    Set up Okta as your SAML 2.0 identity provider for Empuls.
  </Card>

  <Card title="Custom SAML 2.0" icon="key" href="/admin/user-authentication/saml-custom">
    Configure any SAML 2.0-compatible provider, including OneLogin, Ping Identity, and ADFS.
  </Card>
</CardGroup>

## How SSO authentication works

When a user visits the Empuls login page and SSO is enabled, the following happens:

1. The user enters their email address and clicks **Proceed**.
2. Empuls detects the configured identity provider and redirects the user to the IdP login page.
3. The identity provider authenticates the user using corporate credentials.
4. The IdP sends a cryptographically signed response back to Empuls confirming the user's identity.
5. Empuls grants the user access.

No passwords are stored in Empuls when SSO is active. Access is governed entirely by your identity provider.

## Email whitelisting

By default, Empuls sends notification emails from Xoxoday's sending domain. If your organization requires emails to come from your own domain (for example, `notifications@yourcompany.com`), you can configure sender domain verification.

Empuls uses SendGrid (Twilio) as the email gateway. Enabling your domain requires a DNS verification step:

<Steps>
  <Step title="Request domain verification">
    Contact your Empuls account manager or the support team to initiate a Sender Domain Verification request.
  </Step>

  <Step title="Add CNAME records to DNS">
    Empuls generates a set of unique CNAME records for your account. Share these with your IT or DNS administrator and have them added to your organization's DNS host. These records do not conflict with your existing email infrastructure.
  </Step>

  <Step title="Notify Empuls to validate">
    Once the records are in place, notify the Empuls team. They validate the DNS entries to complete the authorization.
  </Step>

  <Step title="Set your sender address">
    Provide the specific "From" email address you want to appear on all Empuls system emails. This address is used for sending only — it does not need an active inbox or mailbox license.
  </Step>
</Steps>

<Tip>
  Email whitelisting is recommended for organizations with strict email security policies (SPF, DKIM, DMARC) or where employees are likely to mark unfamiliar domains as spam.
</Tip>

## FAQs

<AccordionGroup>
  <Accordion title="Can I enable more than one SSO method at the same time?">
    Empuls allows you to enable up to two authentication methods simultaneously in most configurations. To enable multiple custom SSO options at the same time, contact [cs@xoxoday.com](mailto:cs@xoxoday.com).
  </Accordion>

  <Accordion title="What happens to existing users when I enable SSO?">
    Existing users retain access as long as their email address in Empuls matches the identity they authenticate with in the IdP. Users who cannot be matched will be unable to log in until their records are reconciled.
  </Accordion>

  <Accordion title="Can I make SSO mandatory for all users?">
    Yes. When you set a method as the default in User Authentication settings, all users must sign in using that method. Optional SSO allows users to choose.
  </Accordion>

  <Accordion title="Where do I find the Empuls authentication settings URL?">
    Navigate to **Admin Settings → Authentication** in your Empuls admin panel. The URL path is `/admin/authentication-settings`.
  </Accordion>
</AccordionGroup>