Skip to main content
For professional services firms, controlling who has access to client-related workspaces is not optional — it is a professional obligation. Connecting Parlé to your identity provider makes Parlé access a function of your existing user lifecycle: onboard a new associate in Entra ID or Google Workspace and they can sign in immediately; disable them there and they can no longer authenticate to Parlé.
SSO is available on the Business plan and above. If a plan is downgraded below Business, SSO sign-in stops working at the next login and users fall back to email/password.

​
Supported providers

Parlé supports the two identity providers most common in professional services firms:
  • Microsoft Entra ID (formerly Azure Active Directory) — for firms on Microsoft 365
  • Google Workspace — for firms using Google as their identity layer

Set up Entra ID

Full step-by-step guide, including the SharePoint storage setup that reuses the same tenant.

Set up Google Workspace

Full step-by-step guide, including per–Shared Drive storage access.

​
How the connection is configured

SSO is configured by an Org Admin under Org settings → Organization → Single sign-on. What you supply is deliberately minimal: Parlé does not ask you to register an application and paste back a client secret. You grant consent to the Parlé application once, and Parlé holds the connection.

​
How users are matched

Sign-in is routed by email domain, not by account type. Anyone whose verified email at the provider is on your configured domain can sign in to your organization. Configure the domain your firm actually controls, and only that domain.
  • On the login page, a user enters their email address. If the domain matches a configured organization, the Sign in with Microsoft or Sign in with Google button appears.
  • The first time a colleague signs in this way, Parlé creates their account automatically and places them in your organization — provided the domain matches and you have an available seat.
  • Personal @gmail.com addresses cannot sign in to your organization, because gmail.com is not your configured domain.

​
What changes after SSO is enabled

  • Sign-in flow. Users authenticate at your identity provider and return to Parlé. They never set or use a Parlé-specific password.
  • Provisioning. New users in your identity provider can sign in to Parlé without a separate Parlé invitation. An Org Admin still controls which projects they are added to.
  • Offboarding. When you disable, suspend, or delete a user at the identity provider, they can no longer authenticate to Parlé. To close out a departing member completely, also deactivate them in Parlé — see Managing Members — which releases their seat and removes their access to project conversations.
  • Audit trail. Authentication and org configuration changes are written to the audit log.

​
Requiring single sign-on

By default, email and password sign-in stays available alongside SSO. To make SSO the only way in, an Org Admin can switch on Require single sign-on under Org settings → Organization → Single sign-on.
  • You need at least one SSO provider enabled first.
  • The card shows how many active members do not match an enabled SSO domain, with their email addresses. These are typically personal or external accounts.
  • Requiring SSO asks you to confirm. It immediately signs out and blocks the accounts that do not match an enabled domain, and their current sessions cannot be restored.
  • Parlé refuses the change if it would lock you out of your own organization.
  • Select Stop requiring SSO on the same card to turn it back off.