Single sign-on with Microsoft and Google

Your colleagues log in to Boxflow with the work account they already have. Your organisation stays in control: sign-in policies, multi-factor authentication and offboarding all happen in Microsoft Entra ID or Google Workspace.

How it works

Sign in with the account you already have

Users click “Continue with Microsoft” or “Continue with Google” and sign in on the familiar Microsoft or Google page. Boxflow never sees their password.

  • Works with any Microsoft Entra ID tenant and any Google Workspace domain.
  • Multi-factor authentication and the other sign-in rules of your organisation apply automatically.
  • Users are recognised by their email address, so invite colleagues in Boxflow with their work email.

Your choice

Single sign-on only, if you want

Per user, administrators choose which login methods are allowed: email and password, Microsoft, Google, or a combination.

  • Switch off email and password for a user to make single sign-on mandatory.
  • A user who tries a login method that is not allowed is refused.
  • New users receive a welcome email that explains how they can log in.

Microsoft Entra ID

Set up in minutes

There is nothing to install or configure on your side. At most, a Microsoft administrator allows the Boxflow app in Entra ID once.

  1. 1

    Invite your colleagues

    Add users in Boxflow with their work email address and allow Microsoft as login method.

  2. 2

    First sign-in

    At the first sign-in, Microsoft asks to approve Boxflow's basic permissions: sign in and read the user's profile.

  3. 3

    Allow the app

    If your organisation does not let users approve apps themselves, a Microsoft administrator grants consent once for everyone: Entra ID › Enterprise applications › Boxflow › Permissions › Grant admin consent.

Good to know

Boxflow is a multi-tenant Microsoft application, so it works with any Microsoft Entra ID tenant without a separate app registration.

Conditional Access

Your Conditional Access policies apply

Because users sign in through Microsoft Entra ID, your policies are enforced on every sign-in to Boxflow, whether they target all cloud apps or the Boxflow application specifically.

Multi-factor authentication

Require MFA, or phishing-resistant methods, before anyone gets into Boxflow.

Compliant devices

Only allow sign-ins from managed or compliant devices.

Locations

Block sign-ins from countries or networks you do not trust.

Sign-in risk

Block or challenge risky sign-ins with Microsoft Entra ID Protection.

Session controls

Set how often users must sign in again.

Sign-in logs

Every sign-in to Boxflow appears in your Entra ID sign-in logs.

Good to know

Conditional Access requires Microsoft Entra ID P1 or higher; risk-based policies require P2.

Offboarding

Blocked in Entra ID? No access to Boxflow

Access is managed where you already manage your people.

  • Blocked or deleted accounts A user who is blocked or deleted in Microsoft Entra ID can no longer sign in to Boxflow with Microsoft, whatever their status in Boxflow.
  • Removed from the application If assignment is required, removing a user or group from the Boxflow enterprise application also stops their sign-in.
  • Single sign-on only Combine this with single sign-on only, so there is no Boxflow password to fall back on.
  • Open sessions A session that is already open stays valid until it expires. To end access immediately, also remove the user in Boxflow.

Google Workspace

Google Workspace works the same way

Sign in with Google is available for Google Workspace accounts, with the same per-user login settings in Boxflow.

  • Users click “Continue with Google” and sign in with their Workspace account, including 2-Step Verification.
  • Suspended or deleted Workspace users can no longer sign in to Boxflow with Google.
  • Workspace administrators can mark Boxflow as Trusted, Limited or Blocked in the Admin console under Security › API controls › App access control.
  • If Boxflow is blocked there, users can no longer sign in to Boxflow with their Google account.

What our customers say

“My e-Box messages land directly in Odoo thanks to Boxflow. It has really made my workflow more efficient.”
Jacques van Nes · Consultant · BusNes

Frequently asked questions

Which providers does Boxflow support for single sign-on?

Microsoft Entra ID (formerly Azure AD) and Google Workspace.

Do we need to register an app in Entra ID?

No. Boxflow is a multi-tenant application. At most, an administrator grants consent once if users are not allowed to approve apps themselves.

Can we force users to use single sign-on?

Yes. Per user, administrators choose which login methods are allowed; switch off email and password to make single sign-on mandatory.

Do our Conditional Access policies apply?

Yes. Users sign in through Microsoft Entra ID, so policies that apply to all cloud apps or to the Boxflow application are enforced.

What happens when we block a user in Entra ID?

They can no longer sign in to Boxflow with Microsoft. A session that is already open ends when it expires; remove the user in Boxflow to end access immediately.

Ready to put your eBox on autopilot?

Connect your first company for free and receive your government messages wherever you need them.

Start for free