Single sign-on and security

Single sign-on (SSO)

SSO lets your team sign in using their existing Google or Microsoft accounts instead of managing a separate Campfront password. This simplifies access for your team and gives you more control over who can log in.

Supported providers

  • Google - sign in with Google Workspace accounts.

  • Microsoft - sign in with Microsoft 365 or Azure AD accounts.

Enabling SSO

Head to Camp settings > Security to manage your SSO providers. You can enable or disable each provider independently. Once enabled, your team will see the corresponding sign-in button on the login page.

Domain restrictions

You can set one allowed domains list under Camp settings > Security. It applies to everyone joining as an admin, whether they sign in with Google, Microsoft, or accept an email invitation. When set, only email addresses matching those domains can join. For example, set yourcamp.com and only @yourcamp.com addresses can join. It's a single camp-wide list, not one per provider. If left blank, any domain is allowed.

Default role for SSO users

Set one default role under Camp settings > Security. Anyone who joins your team for the first time, whether by accepting an invitation or signing in with SSO, is assigned this role automatically. It's a single camp-wide setting, not one per provider.

Two-factor authentication (2FA)

Two-factor authentication adds an extra layer of security by requiring a verification code in addition to the password when signing in.

Each admin turns on 2FA for their own account from their profile settings, and can choose either method:

  • Text message - a 6-digit code sent to the phone number on file.

  • Authenticator app - scan a QR code with an app like Google Authenticator or Authy, then enter the 6-digit code it generates.

You can switch methods or turn 2FA off at any time. If you turn off your authenticator app, your account falls back to a text message code, or to password only if you haven't added a phone number.

To prevent brute-force attempts, verification is rate limited after too many tries in a short period. If that happens, wait 10 minutes and try again.

Was this helpful?