Company Sign-In

Overview

Company sign-in connects a TagLogger workspace to your identity provider. Members at your company’s email domains sign in with their work login, and directory sync can add and remove them for you.

• Protocols: SAML 2.0 and OpenID Connect. Users sign in from the TagLogger login page, the TagLogger sign-on URL, or a portal tile that opens it. Sign-ins that start at the identity provider are not accepted.
• One connection per workspace, with up to 20 email domains.
• Who sets it up: the workspace owner or an admin opens Settings, Company sign-in. They can also send a setup link to IT, so IT does not need a TagLogger account.
• Who turns it on: only the workspace owner, after a test sign-in passes.

Company sign-in is a plan add-on. Settings, Company sign-in appears once it is part of your plan. To add it, contact us.

Setup Steps

1. In Settings, Company sign-in, pick your identity provider and choose Start setup.
2. Prove you own each email domain with a DNS TXT record (below).
3. Create the TagLogger app in your identity provider with the values TagLogger shows, then enter your identity provider’s details in TagLogger.
4. Choose how members are added: on first sign-in, or by directory sync.
5. Choose Test sign-in and sign in as a user at a verified domain.
6. The owner turns the connection on.

Step-by-step guides: Microsoft Entra ID, Okta, Google Workspace.

Setup Links for IT

The owner or an admin can create a setup link under Setup links and send it to IT. The link opens a setup page that needs no TagLogger account.

• With a link, IT can add and verify domains, enter the identity provider details, choose how members are added, run the test, and create directory sync tokens.
• A link lasts 72 hours and the full address is shown once. Up to 3 links can be active, and each can be revoked.
• Links work only before the connection is on. Turning it on revokes every link.

Verify Your Domains

Add each email domain under Domains. TagLogger shows a TXT record to add at your DNS provider:

Name:  _taglogger-verification.example.com
Type:  TXT
Value: tl-verify=<token shown in TagLogger>

• Choose Check record once the record is published. DNS changes can take a few hours to appear.
• Keep the record. TagLogger checks it daily. If it disappears, members at that domain keep signing in for 7 days, then stop until the record is back.
• Company sign-in admits only email addresses at verified domains.

Values for Your Identity Provider

TagLogger shows these values with your connection ID filled in, labeled with the names your identity provider uses. Copy them from Settings rather than typing them.

Then enter your identity provider’s details in TagLogger under Identity provider:

• SAML: a metadata URL, a metadata file (upload or paste), or the entity ID, sign-in URL, and signing certificate entered by hand. With a metadata URL, TagLogger reads it daily and picks up new signing certificates by itself.
• OpenID Connect: the issuer, client ID, and client secret.

The identity provider must send the user’s email address. For SAML, send it as the NameID in email address format and as an email attribute. The address must be the one the person uses for TagLogger, at a verified domain. Sign the SAML assertion and do not encrypt it; TagLogger does not accept encrypted assertions.

How Members Are Added

For directory sync, give your identity provider:

• SCIM base URL: https://api.taglogger.com/scim/v2
• A token from Create token, sent as a bearer token. The full token is shown once. Up to 2 tokens can be active, so you can rotate without downtime.

The SCIM API supports Users and Groups, with filters and paging of up to 100 results. Under Directory groups in Settings, map up to 50 groups to View, Change, or Admin access; a member in several mapped groups gets the highest role and the union of their tags. Only the workspace owner can map a group to admin, and a token that was not created by the owner cannot sync while an admin group is mapped. Members set by groups are edited in your directory, not in TagLogger, and keep their access if you turn directory sync off. userName is required and should be the user’s sign-in name or email. A sign-in matches a directory user by that name or by email. Deleted users are kept for 90 days, then removed. Switching back to first sign-in revokes every directory sync token.

Test and Turn On

• Test sign-in signs in through your identity provider in a separate window. You stay signed in as yourself, and an account the test created is removed. It runs on taglogger.com.
• A passed test counts for 7 days. If the settings change after the test, test again.
• When the test passes, the owner turns the connection on.

Sign-In Policy

• Sign-in: Any login lets members keep their password or Google login. Company sign-in only makes members at your domains use company sign-in. Before requiring it, the owner sets up an authenticator app, which keeps the owner’s own way back in if the identity provider is down.
• Guests: Allow guests lets you invite people outside your domains. Company accounts only removes guests and pending invites.

Turning the connection off, or deleting it, is in the Turn off or delete group. Members who only ever used company sign-in are signed out.

Security Events

TagLogger records company sign-in security events: denied sign-ins, the owner signing in with the authenticator app, setting, domain and certificate changes, test sign-ins, members added and removed, and directory sync tokens and setup links created or revoked. The newest show under Recent activity.

• Download CSV saves every event, oldest first. The owner and admins can download it.
• For a SIEM, read GET https://api.taglogger.com/v1/security-events with an API key that has the read:security-events scope and access to all tags. Events come oldest first, up to 500 a page. Pass the nextCursor you got as cursor to read only newer events; use since for the first read.
• Or subscribe an API webhook to the security.event event. Each delivery carries one event, the same as the API returns. A webhook gets it only when you name it in its events.

Troubleshooting

The SCIM API answers 401 for a missing or revoked token, 403 when the connection is not on or does not use directory sync, 409 for a duplicate user name or email, 429 when your identity provider sends too many requests, and 503 while TagLogger has paused directory sync. Your identity provider retries a 503 by itself.

See Also

• Microsoft Entra ID
• Okta
• Google Workspace