Platform
Single sign-on with your identity provider
Each company signs its people in with its own identity provider, provisions them with SCIM and sets its own sign-in policy. Thoshika stays the source of truth for what each person can open.
What you can set
Identity and sign-in controls
Company administrators set all of this under Admin, Single sign-on. No support ticket is needed.
| Feature | What it does |
|---|---|
| SAML 2.0 and OpenID Connect | Connect any standard identity provider per company, by metadata or discovery URL |
| Provider presets | Microsoft Entra ID, Google Workspace and Okta |
| Several providers | Any number per company; each verified email domain routes to one |
| Domain verification | A DNS TXT record proves the domain; one company per domain |
| Sign-in by email | People type their work email and are sent to the right provider |
| Enforced SSO | Passwords switched off for your domains, with up to five break-glass administrators |
| Just-in-time accounts | Accounts and default roles created on first sign-in, if you allow it |
| SCIM 2.0 | Users and groups provisioned and deactivated by your provider; groups map to Thoshika roles |
| MFA policy | Nobody, administrators or everyone; passkeys, authenticator codes and SSO all count |
| Session limits | Idle and absolute session timeouts per company |
| IP allowlist | Restrict sign-in and every API call to your networks, with lock-out protection |
| Allowed methods | Choose which of password, passkey and SSO each company accepts |
| Sign-in log | Successes, failures and blocks, with method, provider and IP address |
| Mobile | SSO on the Android and iOS apps through a one-time hand-off code |
| Group policies | Sign-in policies set once for a group of companies rather than company by company |
| Signed and encrypted SAML | Signed authentication requests and encrypted assertions |
| IdP-initiated sign-in and single logout | Start from your identity provider’s app launcher, and sign out everywhere at once |
| SCIM bulk operations | Bulk create, update and deactivate in one SCIM request |
Without an identity provider
Passkeys and passwords, done properly
Smaller companies can sign in without SSO. The sign-in screens are Thoshika's own, on the web and in the apps.
- Passkeys with Touch ID, Windows Hello and Android or iOS devices
- Authenticator app codes as a second factor
- Short-lived access tokens; refresh tokens rotate and a reused one ends the session
- People see and end their own sessions and passkeys under Profile, Security
Rolling out to a large team?
We can help you connect your identity provider and plan the switch to enforced SSO.