Sign-in security
Sign-in security controls two-step verification for password sign-in, and single sign-on through your company's identity provider. Nothing changes for anyone until you turn it on.
Two-step verification
Choose a mode:
| Mode | Effect |
|---|---|
| Off | Not used. People who set it up earlier aren't asked for a code. |
| Optional | Anyone can turn it on from their profile; those who do are asked for a code at sign-in. |
| Required | The chosen people must set it up. After the grace period they can't sign in until they do. |
When it's required:
| Field | What it does |
|---|---|
| Required for | Everyone, Admins, or Selected roles. |
| Grace period (days) | Time people have to set it up. It starts when you save. |
| Allow email codes | People can get a code by email if they don't have their phone. |
| Remember devices for (days) | How long a device is trusted. 0 asks for a code at every sign-in. |
Each person sets it up from Account → Security with an authenticator app, and keeps recovery codes. If someone loses their phone, an admin can reset it in User role mapping.
Single sign-on
People can sign in with Microsoft Entra ID, Okta, Google Workspace, ADFS and other providers, using OpenID Connect or SAML 2.0.
| Mode | Effect |
|---|---|
| Off | Everyone signs in with their HCM Cafe user name and password. |
| Optional | The sign-in page shows a single sign-on button; passwords still work. |
| Required | People must use single sign-on. Passwords stop working, except emergency access for admins. |
Set it up
- Choose the Protocol.
- Register the values shown under Register these values with your identity provider in your provider:
- SAML: Entity ID (audience), Reply URL (Assertion Consumer Service) and Metadata URL.
- OpenID Connect: Redirect URI.
- Enter your provider's details:
- SAML: Identity provider entity ID (issuer), Identity provider sign-in URL and Identity provider signing certificate.
- OpenID Connect: Issuer URL, Client ID, Client secret (only for confidential web apps) and Scopes.
- Match users by: the claim holding the HCM Cafe user name or email. Leave empty to use email.
- Set the Button text, choose Optional, and save.
- Test with one account. The page shows when single sign-on last succeeded. Then switch to Required if you want.
Emergency access for admins lets admins who use two-step verification still sign in with a password and code when single sign-on is required, for example if the provider is down.