Sign in options for your organisation
For IT teams: how Google, Microsoft and Apple sign in work with Lifetick, what we ask those services for, and how single sign-on through your own identity provider works.
There are three ways people sign in to Lifetick. You can leave the choice to each person, or turn on single sign-on so everyone in your organisation signs in through your own identity provider.
| Who sets it up | Can you make everyone use it? | |
|---|---|---|
| Email and password | Each person | No |
| Google, Microsoft or Apple | Each person | No |
| Single sign-on | We set it up with you | Yes |
Email and password
Anyone can create an account with their email address and a password. Passwords are stored hashed. People can reset their own password by email.
Sign in with Google
People choose Continue with Google on the web or the iPhone app and sign in with their Google account, including a Google Workspace school or work account.
Lifetick asks Google for the person's name and email address only. It doesn't read Gmail, Drive, Calendar or anything else in the account.
If your Google Workspace only allows apps your admin has approved, approve Lifetick in the Google Admin console before people try it.
Sign in with Microsoft
People choose Continue with Microsoft and sign in with a work or school account (Microsoft 365 or Entra ID), or a personal Microsoft account.
Lifetick asks Microsoft for sign-in and the person's basic profile: the permissions are openid, profile, email and User.Read. It doesn't read mail, files, Teams or calendars.
If your Microsoft 365 tenant doesn't let people approve apps themselves, they see a message asking for an admin's approval. An IT admin can grant consent for Lifetick once, for the whole organisation, in the Entra admin centre.
Sign in with Apple
On iPhone and the web, people can choose Continue with Apple. Apple may give Lifetick a private relay address instead of the person's real email address. That's fine on a personal account, but in a team or school it's best to sign in with the same email address the organisation invited.
Matching people to your organisation
Google, Microsoft and Apple sign people in to the Lifetick account with the same email address. To join your organisation, people still need to be invited, or join with your invite link. Signing in with a work Google or Microsoft account doesn't add anyone to your organisation by itself.
Single sign-on for your whole organisation
With single sign-on, everyone in your organisation signs in through your own identity provider, such as Entra ID, Okta or Google Workspace. Lifetick uses WorkOS to connect to it. Your identity provider's own rules, such as two-step verification, apply to every sign-in.
Once it's on:
- Everyone uses it. Owners, admins, managers and team members, or teachers and students. Passwords and Continue with Google, Microsoft or Apple stop working for them.
- No Lifetick passwords. There's nothing to reset in Lifetick, and welcome emails don't include a temporary password.
- The email has to match. The account at your identity provider must have the same email address as the person's Lifetick account, and belong to your organisation's connection.
- Accounts aren't created for you. Add or invite people in Lifetick first. Single sign-on signs in people who already belong to your organisation.
- Leavers. Once someone's removed from your directory, they can't sign in. Deactivate them in Lifetick too so they stop counting towards your bill.
Single sign-on is for team and school accounts. To set it up, email [email protected]. See Single sign-on for what your people will see.
