# How members sign in

Organisation → **How members sign in** decides how members get into draften.
The **organisation owner** changes the bindings and the clients.

## Three ways in

| Way | When it applies |
|---|---|
| Microsoft account | the organisation is bound to a Microsoft 365 (Entra) directory and has an Entra registration set |
| Google account | the organisation lists its Google Workspace domain and has a Google OAuth client set |
| password from the invitation | the organisation has no Microsoft or Google client |

When an organisation signs in with Microsoft or Google, it uses no passwords
— and whoever leaves the directory is out of draften too. Members' passwords
stop working the moment the organisation sets a client.

The sign-in page asks for the e-mail first: it tells the organisation and
offers only the ways in the organisation has.

## Directory binding

**Microsoft directory (Entra) ID** — the tenant ID of the Microsoft 365
directory. Sign-in always runs against this directory; an account of another
directory is refused before draften sees it.

**The organisation's e-mail domains** — comma-separated. A Google account
signs in when its Workspace domain is listed (list the primary domain; Google
never sends an alias domain). The self-service goes by the domains too.

Without a directory ID and domains the organisation signs in with passwords.

## Self-service

Both switches are off by default.

**Join from the directory automatically** — whoever signs in with an account
of the organisation's directory and has an address of a listed domain becomes
a member, always with the member role. You need not add them first.

**Mailbox automatically** — such a member gets, at sign-in, a mailbox of
their address with the owner right (just the mailbox; they make the assistant
themselves). The mail access is bound to the organisation's app registration
when exactly one is active for that mail system; otherwise they connect the
mailbox themselves.

## Clients for Microsoft and Google

The **Account sign-in and mailbox connections** card holds the access details
of the apps through which draften talks to Microsoft and Google for your
organisation. You create them in your own Entra ID and Google Cloud; the
secrets are stored encrypted. The card also shows the **redirect URIs** to
register with the provider.

**Entra registration** — an App registration in Entra ID (accounts of this
directory only) with the delegated permissions `openid`, `profile`, `email`,
`Mail.ReadWrite`, `MailboxSettings.ReadWrite`, `User.Read` and
`offline_access`, and both redirect URIs from the card. It serves signing in
with Microsoft and the **Connect Outlook** button.

**Google OAuth client** — in the organisation's Google Cloud: APIs & Services
→ Credentials → OAuth client ID (Web application) in a project with the Gmail
API enabled, and a consent screen of the **Internal** type with the scopes
`openid`, `email`, `profile` and `gmail.modify`. Internal means your domain's
accounts only and no verification by Google. It serves signing in with Google
and **Connect Gmail**.

## Invitations and outgoing mail

A new member gets an invitation by e-mail only when the organisation (or the
installation) has [outgoing mail](/en/admin/outgoing-mail) set up. Without
it, the member is added too, only nobody tells them. For an organisation that
signs in with passwords, though, they have no way to set one — outgoing mail
is a must there.