Switched on for you on request. Microsoft and Google sign-in are being switched on now. Until they are, everyone signs in with their email and password. Email hello@suppliervault.co.uk if your organisation needs them and we'll tell you when they're ready.
Most organisations already have a Microsoft 365 or Google Workspace account for every member of staff. SupplierVault lets people use that account instead of a separate password, so IT controls who can get in, their usual two-step checks apply, and there's one less password to forget.
The three ways to sign in
| Button | Accounts it works with |
|---|---|
| Continue with Microsoft / Sign in with Microsoft | Microsoft 365 work and school accounts (Microsoft Entra ID, formerly Azure AD). |
| Continue with Google / Sign in with Google | Google Workspace accounts and personal Google accounts. |
| Email and password | Any email address, with a SupplierVault password. |
SupplierVault matches accounts by email address. If you first signed up with a password and later click Continue with Microsoft using the same email, you get the same account, organisations and history.
How to sign in with Microsoft or Google
- Go to the SupplierVault sign-in page (or click Accept invitation in your invitation email).
- Click Sign in with Microsoft or Sign in with Google.
- Microsoft's or Google's own page opens. Choose your work account and complete any checks your organisation uses (such as the Microsoft Authenticator prompt).
- You're brought back to SupplierVault and signed in. If you were invited, you're added to the organisation straight away.
If your IT team needs to approve SupplierVault (Microsoft)
Many Microsoft 365 organisations stop staff from signing in to a new app until IT has approved it. If that applies to you, you'll see "Your organisation's IT team needs to approve SupplierVault in Microsoft before you can sign in this way."
What to tell your IT team:
- SupplierVault asks only for basic sign-in permissions: your name, email address and sign-in (OpenID Connect:
openid,email,profile). It doesn't read mail, files, calendars or anything else in Microsoft 365. - An admin can approve it once for the whole organisation by signing in with Microsoft and accepting on behalf of the organisation, or in the Microsoft Entra admin centre under Enterprise applications.
- They can also limit who can use it by assigning users or groups to the SupplierVault enterprise application.
Until it's approved, you can sign in with your email and a password.
Make company sign-in the only way in (admins)
- Sign out, then sign back in with your Microsoft or Google Workspace work account. (This makes sure you can't lock yourself out.)
- Open the account button › Organisation. Check the list of people who haven't signed in with a work account yet: they'll be asked to the next time they open SupplierVault.
- Tick Company sign-in only: "Everyone in … must sign in with Microsoft or Google (no SupplierVault passwords)".
From then on:
- Only work accounts count: Microsoft Entra ID (Microsoft 365) or Google Workspace. Personal Google accounts don't.
- Each work-account sign-in lasts 12 hours, then SupplierVault asks Microsoft or Google again. Usually that's one click, because people are already signed in to Microsoft or Google.
- Anyone who signs in with a password sees "Sign in with your work account" and can't open your organisation. The database checks this on every request, not just on screen.
- Existing calendar links stop working; people create new ones from the You tab.
Untick the box to allow passwords again. If Microsoft or Google sign-in ever stops working, an admin can sign in with a password and their SupplierVault two-step code and click Turn off company sign-in on the "Sign in with your work account" screen.
You can also require SupplierVault two-step sign-in, though most organisations rely on Microsoft's or Google's own two-step checks.
Lock sign-in to your own company (admins)
Company sign-in only makes everyone use a Microsoft or Google Workspace work account, but by default any company's work account will do, as long as its email was invited. To make sure only your own staff can get in, lock it to your company's Microsoft tenant or Google Workspace domain. Then an account from another company can't get in, even with an invitation.
It's on the account button › Organisation, under Company sign-in only. The line Only staff of your company: says "not locked" or what it's locked to.
- Sign in with your own Microsoft or Google Workspace work account.
- Select Lock to my company's account. SupplierVault adds your own Microsoft tenant or Google Workspace domain. You'll see "Locked. Only accounts from your company can sign in with Microsoft or Google."
- To add another, for example a second tenant after a merger, type a Microsoft tenant ID (such as 72f988bf-86f1-41af-91ab-2d7cd011db47) or a Google Workspace domain (such as yourcompany.co.uk) in the box and select Add.
- Make sure Company sign-in only is ticked. The lock is checked when people sign in with their work account under company sign-in only.
- Your Microsoft tenant ID is in the Microsoft Entra admin centre, on the Overview page.
- Each tenant and domain is listed with a Remove button. You can have up to 10 tenants and 10 domains.
- If you list only Microsoft tenants, Google accounts can't get in, and the other way round. List both if your staff use both.
- You can't lock yourself out. While company sign-in only is on, a change is refused unless your own work account is still allowed: "Sign in with a Microsoft or Google Workspace account that these settings allow yourself first, so you can't lock yourself out."
- Before you switch company sign-in only on, the tab lists anyone not yet signed in with a work account the lock allows. They'll be asked to sign in with one next time.
- Changing the lock while company sign-in only is on ends existing calendar links. People create new ones from the You tab.
- If you see "Sign out and sign back in with your company's Microsoft or Google Workspace account first, then try again.", your current session didn't use a work account.
When someone leaves
- Remove them from the account button › Team tab, and use Hand over work on the Stakeholders page.
- Turning off their Microsoft or Google account stops them signing in again. With Company sign-in only on, an open session also ends within 12 hours. Removing them from the Team tab ends it straight away.
- On the Enterprise plan, Microsoft Entra ID (or Okta) can do this for you: when IT switches someone off, they lose access to SupplierVault straight away, and starters are added when IT assigns them. Google Workspace can't do this for apps like SupplierVault, so use Company sign-in only instead. See Add and remove people automatically.
Good to know
- Use the same email address your colleague invited. A personal Gmail or a different alias won't match the invitation.
- If Microsoft doesn't share a verified email address for your account, invitations can't be matched to it. Ask IT, or sign up with a password using the invited email.
- SAML single sign-on for other identity providers (such as Okta or OneLogin) isn't available yet. Email hello@suppliervault.co.uk if you need it. Okta can still add and remove people automatically; they then sign in with Microsoft, Google or a password.
- Suppliers never use your company sign-in. They use their own secure, time-limited portal links, or a free supplier account of their own.
Single sign-on with your own identity provider (SAML)
On the Enterprise plan, your organisation can also sign in through its own identity provider, such as Microsoft Entra ID, Okta, Google Workspace or JumpCloud, using SAML. People then select Sign in with SSO (SAML) on the sign-in page and enter their work email. Sign-ins this way count as company sign-ins for "Company sign-in only". See Single sign-on with SAML.
Related
- Account, team and security
- Invite your team
- Security and your data
- FAQ and troubleshooting
- Add and remove people automatically
- Single sign-on with SAML