Single Sign-On
Your Team Signs In The Way It Already Does.
ChangeTower supports SAML 2.0 single sign-on, so your team reaches it through the identity provider they already use. Whatever sign-in policy that provider enforces, multi-factor included, applies here too, because the sign-in happens there. No separate password to set, forget or reset.
Welcome back
One connection, set up once. After that a teammate signs in with the account they already have, under the rules your provider already enforces.
A separate password is a separate problem.
Every tool that sits outside your directory is one more credential nobody planned for, and one more line on a checklist somebody has to remember.
Another password to look after
A tool your team signs into with its own credentials is a tool your team writes that credential down for. Reset requests land on whoever set it up, and nobody outside the account knows who still has access.
Sign-in policy that stops at the door
You have spent real effort on multi-factor, session rules and conditional access. None of it reaches a tool that does its own authenticating, so the weakest sign-in in the stack is the one nobody is looking at.
Sign-in moves to where it already lives.
ChangeTower hands authentication to your identity provider over SAML 2.0. Your provider decides who gets in and on what terms, and ChangeTower takes its word for it.
Your provider does the authenticating
Sign-in happens on Microsoft Entra ID or Google Workspace, not here. ChangeTower never receives a password and has nothing to store, leak or reset.
Your policy comes with it
Multi-factor, conditional access, session length, device rules. Whatever your provider enforces at sign-in applies to ChangeTower too, because that is where the sign-in is happening.
We set it up with you
Single sign-on is on the Enterprise plan and is configured by our team alongside yours. You tell us which provider you use, we exchange the connection details once, and it is done.
Single sign-on changes how people sign in, not who has an account.
Worth being exact about, because the two get assumed together and they are not the same job.
Authentication
Getting the right person through the door, using the account and the rules you already have.
- Teammates sign in through Microsoft Entra ID or Google Workspace
- SAML 2.0, so ChangeTower never receives or stores a password
- Your provider's sign-in policy applies, multi-factor included
- One less credential living outside your directory
- Configured once with your IT team, on the Enterprise plan
Accounts and access
ChangeTower does not read your directory and does not sync with it. There is no SCIM integration and no automatic provisioning, so the account list here is maintained here.
- Creating accounts. A teammate needs an account in ChangeTower before single sign-on has anything to sign them in to
- Removing accounts. Taking somebody out of your directory does not remove their ChangeTower account. That is still a job somebody does here
- Roles and permissions. Set per person in ChangeTower. Your directory groups are not read and do not map to roles
- Onboarding and offboarding stay manual, on both sides
Put the ChangeTower account on the same offboarding checklist as everything else, and set what each person can reach with role-based access.
Signing in is the first thing your team does together.
Single sign-on decides how people get in. What happens after that is the part built for more than one person.
Role-Based Access
Not everyone needs everything. Build a role permission by permission, so a teammate can see every notification and never touch a monitor, or handle billing and nothing else.
Learn more →Workspaces
A workspace for each client, project or department, with its own monitors, alerts and history inside it. Everyone invited to that workspace sees the same thing, so a client engagement is not mixed in with internal tracking and nobody is working around one shared dashboard.
Learn more →Workflow States
A change arrives and somebody has to decide what happens next. Mark it reviewed, flag it as important, and the whole team sees that straight away. Nothing gets triaged twice, and nothing sits unresolved because everyone assumed somebody else had picked it up.
Learn more →Bring ChangeTower under your identity provider.
SAML 2.0 single sign-on is available on the Enterprise plan. Tell us whether you are on Microsoft Entra ID or Google Workspace, and our team will set it up with yours.