Restrict Login Methods and Email Domains

Overview

Calentix provides organization administrators with the ability to centrally control the allowed login methods and email domains for their organization. These settings apply to all teams within the organization and are checked at every login.

Restrict Login Methods

Under Team Settings → Security, you can specify which login methods are allowed for the organization:

• Google: Login via Google account

• Microsoft: Login via Microsoft account (Azure AD)

• Email & Password: Classic login with email address and password

• Enterprise SSO (SAML): Login via your company's identity provider

No selection means all methods are allowed. Once at least one method is selected, all unselected methods are blocked.

Example: Allow only SSO

Select only “Enterprise SSO (SAML)”. Employees attempting to log in via email/password or Google/Microsoft will receive an error message indicating they must log in via SSO.

Example: Allow Google and Email

Select “Google” and “Email & Password”. Microsoft login and SSO will be blocked.

Restrict Email Domains

Additionally, you can specify which email domains are allowed for the organization. Only users with an email address from these domains can log in or be invited.

Example

Domain: mycompany.com

→ Only firstname@mycompany.com can log in. Users with name@gmail.com will be denied.

Self-Lockout Protection

Calentix automatically protects administrators from accidental self-lockout:

• they cannot remove their own email domain from the allowed list.

• they cannot block all their own login methods.

If they do accidentally lock themselves out, our support team can be contacted.

Impact on Invitations

The domain restrictions also apply to team invitations. If an employee with a non-allowed domain is invited, an error message will be displayed.

Multiple Organizations

If a user is a member of multiple organizations, the strictest rule applies: Only login methods allowed in all organizations will work.