Organisation → How members sign in decides how members get into draften. The organisation owner changes the bindings and the clients.
Three ways in
| Way | When it applies |
|---|---|
| Microsoft account | the organisation is bound to a Microsoft 365 (Entra) directory and has an Entra registration set |
| Google account | the organisation lists its Google Workspace domain and has a Google OAuth client set |
| password from the invitation | the organisation has no Microsoft or Google client |
When an organisation signs in with Microsoft or Google, it uses no passwords — and whoever leaves the directory is out of draften too. Members' passwords stop working the moment the organisation sets a client.
The sign-in page asks for the e-mail first: it tells the organisation and offers only the ways in the organisation has.
Directory binding
Microsoft directory (Entra) ID — the tenant ID of the Microsoft 365 directory. Sign-in always runs against this directory; an account of another directory is refused before draften sees it.
The organisation's e-mail domains — comma-separated. A Google account signs in when its Workspace domain is listed (list the primary domain; Google never sends an alias domain). The self-service goes by the domains too.
Without a directory ID and domains the organisation signs in with passwords.
Self-service
Both switches are off by default.
Join from the directory automatically — whoever signs in with an account of the organisation's directory and has an address of a listed domain becomes a member, always with the member role. You need not add them first.
Mailbox automatically — such a member gets, at sign-in, a mailbox of their address with the owner right (just the mailbox; they make the assistant themselves). The mail access is bound to the organisation's app registration when exactly one is active for that mail system; otherwise they connect the mailbox themselves.
Clients for Microsoft and Google
The Account sign-in and mailbox connections card holds the access details of the apps through which draften talks to Microsoft and Google for your organisation. You create them in your own Entra ID and Google Cloud; the secrets are stored encrypted. The card also shows the redirect URIs to register with the provider.
Entra registration — an App registration in Entra ID (accounts of this directory only) with the delegated permissions openid, profile, email, Mail.ReadWrite, MailboxSettings.ReadWrite, User.Read and offline_access, and both redirect URIs from the card. It serves signing in with Microsoft and the Connect Outlook button.
Google OAuth client — in the organisation's Google Cloud: APIs & Services → Credentials → OAuth client ID (Web application) in a project with the Gmail API enabled, and a consent screen of the Internal type with the scopes openid, email, profile and gmail.modify. Internal means your domain's accounts only and no verification by Google. It serves signing in with Google and Connect Gmail.
Invitations and outgoing mail
A new member gets an invitation by e-mail only when the organisation (or the installation) has outgoing mail set up. Without it, the member is added too, only nobody tells them. For an organisation that signs in with passwords, though, they have no way to set one — outgoing mail is a must there.