Overview
Single sign-on (SSO) lets your team sign in to ComplyJet with their existing Microsoft or Google work account instead of a separate ComplyJet password. It's optional and off by default — an Admin can turn it on at any time from Settings, and nothing changes for your organization until you do. You choose one provider for your organization at a time — Microsoft or Google — matching whichever your company already uses.
What changes when SSO is on
Employees whose email is on your company's domain sign in with their Microsoft or Google work account only — there's no ComplyJet password for them anymore.
Admins can also sign in with SSO, but always keep their password as a backup, so an Admin is never at risk of being locked out.
Anyone whose email is not on your company's domain — a contractor on a personal or different work email, for example — keeps signing in with their ComplyJet password. They aren't offered SSO.
Invite links and "Forgot password" continue to work for everyone, regardless of SSO.
Enabling SSO for your organization
Only an Admin can turn SSO on.
Go to Settings > Login & Security.
In the Single sign-on (SSO) panel, switch the toggle on.
3. Select Microsoft or Google from the Provider dropdown, matching whichever account your team already signs in with.
That's the entire setup — there's no client ID, secret, or tenant configuration to enter on your end for either provider. ComplyJet's Microsoft and Google sign-in are preconfigured, so the next time someone on your domain logs in, they'll be sent to your chosen provider to sign in (and briefly consent, the first time only).
How signing in works once SSO is on
Logging in is now a two-step process: you enter your email first, and ComplyJet then shows either a password field or a "Continue with Microsoft" / "Continue with Google" button — matching whichever provider your organization has selected — depending on your account and your organization's SSO setting. Admins, and anyone whose email domain doesn't match the company's, will always see the password option as well.
Keeping access in sync with your identity provider or HR system
Separately from SSO, ComplyJet can automatically keep who has access in sync with a connected HR system (BambooHR, Gusto, Rippling, Deel, Zoho People, and others) or with an identity provider itself (Microsoft 365 / Entra ID, Google Workspace, Okta). Connect one of these under Integrations, then check or change which one ComplyJet treats as your primary employment source under Settings > Tool Preferences.
What happens when someone leaves
Once a primary employment source is set, ComplyJet checks it on every sync. If that source stops listing someone, or reports them as a former employee or contractor, ComplyJet marks them as Former in ComplyJet and automatically disables their ComplyJet login. Admin accounts are never disabled this way.
What happens if someone comes back
If that same person becomes active again in your primary source, and their ComplyJet login is still the one that sync disabled, ComplyJet automatically restores their status and re-enables their login — no admin action needed.
Manual changes always take precedence
If an Admin manually marks someone as offboarded rather than waiting for sync, that decision sticks. The nightly sync will never re-enable someone an Admin disabled by hand.
FAQ
Do I need to register anything with Microsoft or Google myself?
No. ComplyJet's Microsoft and Google sign-in are single shared integrations — there's nothing to configure on your end beyond the toggle and provider selection.
Can I get locked out if I turn SSO on?
No. Admins always keep their password as a backup sign-in option, even with SSO on.
Does SSO apply to contractors or anyone on a different email domain?
No. Only accounts on your company's registered email domain are required to use SSO. Everyone else keeps using a ComplyJet password.
Can we use both Microsoft and Google at the same time?
No, you pick one provider for your organization at a time. If you need to switch later, an Admin can change the provider under Settings > Login & Security.
Is SSO the same thing as the HR/IdP sync described above?
No — they're independent. You can turn on SSO without connecting an employment source, and you can set a primary employment source without ever turning SSO on. Most customers use both together.