Organization Owners can choose Google Workspace and Microsoft Entra ID sign-in, then decide whether people using the organization’s company email domains may still use an email one-time password.
These settings follow the person’s company email domain. Members invited from other domains follow their own email domain’s sign-in settings. Invited outside viewers use guest email codes unless an Owner disables outside sharing; see Organization artifact access.
Email codes
Email one-time password (OTP) sign-in is available by default:
- Enter your email address.
- Display.dev sends a six-digit code.
- Enter the code to finish signing in.
The dashboard and dsp login use the same flow. Turning on Google or Microsoft does not disable email codes.
Configure single sign-on
Google and Microsoft single sign-on (SSO) require Pro or Enterprise. Both providers are available when SSO first becomes available; an Owner can keep both or turn either one off from Settings → Organization → General → Single sign-on:
- Turn on Google Workspace, Microsoft Entra ID, or both.
- If you enable Microsoft, optionally enter the Azure Tenant ID shown in the dashboard. Microsoft also calls this value a Directory ID.
- Select Save.
If both providers are enabled, members can choose either one. On Free or Solo, the settings page links to Settings → Organization → Billing instead of enabling the provider controls.
Restrict Microsoft to one directory
The Azure Tenant ID field is optional. When set, Display.dev checks the directory identifier returned by Microsoft during sign-in and rejects accounts from another directory.
Saving the setting stores the identifier. The check happens when a member signs in, not when you save.
Enforce SSO
Turn on Require SSO for company email domains only after at least one SSO provider is enabled. Enforcement changes the sign-in paths:
- People using your organization’s company email domains must use an enabled Google or Microsoft provider.
- Email-code sign-in stops working for those domains, including
dsp loginwith an email code. - Existing email-code sessions continue until they need to authenticate again.
The dashboard asks for confirmation before enabling enforcement.
Enforcement follows the recipient's email domain rather than the organization inviting them. When an Owner allows invitations to any email address, a Gmail member can sign in with an email code or a personal Google or Microsoft account even if the inviting organization enforces SSO. An invitee using another organization's company email domain follows that domain's provider restrictions and SSO enforcement.
Change or remove a provider
To remove the last enabled SSO provider, turn off Require SSO for company email domains first and save. Then disable the provider and save again. Email-code sign-in remains available.
Disabling one provider does not affect another enabled provider. Members already signed in may keep their current session until they need to authenticate again.
On Solo or Free, your saved SSO enforcement setting is inactive, so members can sign in with email OTP. The setting applies again when you upgrade to Pro or Enterprise. An Owner can still turn off enforcement on any plan.