SSO auto-enrollment (Google Workspace, Microsoft 365)

There is no self-serve SSO auto-enrollment yet; use the shareable join link, where an employee signs in with their work email and an admin approves the request.

Teams often ask for domain-based auto-enrollment: anyone with an @yourcompany.com address lands in the program automatically. That is not shipped for self-serve setup.

What exists today

Two paths cover the same need without it.

HRIS sync

If you run BambooHR, Personio or Workday, connect it once. A sweep runs daily at 02:00 Asia/Baku and pulls your active directory, so new hires appear without anyone touching a CSV. See HRIS sync.

The join link

The lower-effort option, and usually the one that grows a program fastest.

Copy the join link from the Employees tab
Post it where your team already is: an intranet page, a Slack channel, an all-hands slide
An employee opens it, signs in with their work account, picks their department and requests access
An admin approves from the pending queue

The link is signed and self-contained, and approval is the real gate: a leaked link only ever lets someone request, never auto-join. That is exactly the property domain auto-claim would have to reproduce, so the join link is not a worse version of SSO, it is a different trade.

What is missing without SSO

No single sign-on session shared with your other internal tools
No automatic enrollment purely from a verified email domain
No DNS-based domain claim

If those are hard requirements for a rollout, raise it with your account manager rather than waiting for a self-serve toggle.

Frequently asked questions

Can employees sign in with their work Google account?

They can sign in to Keepface with Google, which is the account they then use to request access through your join link. What is not shipped is automatic enrollment purely from a verified email domain.

So how do new hires get in without manual work?

Either an HRIS connection, which syncs the directory daily, or the join link, which lets people add themselves and only asks an admin to approve.

Is approval a lot of work?

It is one tap per request, in a queue. And it is the reason a leaked join link costs you nothing.

When will SSO auto-enrollment ship?

There is no committed date. Enterprise pilots are handled case by case through your account manager.