How to connect:

Click on the 3 dots in the right hand corner, then click on Account settings:
Click into the Security tab and select SSO:
(Make sure to mark the checkbox by Google SSO or Microsoft SSO)

Before you connect: the employee needs to exist in Shapes first

SSO only handles authentication — it doesn't create employees. The person signing in must already exist (and be invited) in Shapes before SSO will work for them.

If your account also has the Google Workspace or Microsoft Entra ID integration connected, that syncs users automatically — including creating them in Shapes — which removes the need for a manual invite.

Multi-SSO Support

Shapes accounts support connections to multiple SSO domains. Organizations utilizing more than one identity provider or managing multiple domains can streamline their authentication process.

Google SSO
Microsoft SSO

Both Google and Microsoft SSO connections can be active simultaneously. To configure, go to Account Settings → Security → SSO and add your SSO domains.

Security and Access Control

Adding a domain enforces SSO for that domain immediately and account-wide. There is no staged rollout and no way to require it for some users on the domain but not others.
Shapes has no native two-factor authentication setting. Multi-factor authentication is enforced at your identity provider — for example, Conditional Access in Microsoft Entra — and Shapes inherits whatever the provider requires at login.
Disabling a user at your identity provider blocks new logins, but it does not end a Shapes session that is already active. Offboarding a user has to also deactivate or terminate them inside Shapes.
The in-platform Activity Log covers changes to employee data. It does not cover account-level security events such as SSO configuration or domain changes.

Overview

Shapes uses OpenID Connect (OIDC) for authentication. We only request the minimum set of standard scopes required to identify a user:

Name
Email address

We do not request access to any sensitive or extended data such as:

Emails or mailboxes
Calendars
Files or drives
Directory data beyond basic profile

Required Scopes by Provider

Microsoft Entra ID (Azure AD)

Scopes required:

openid
profile

Details:

Authentication is handled via OAuth 2.0 Authorization Code flow
Endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
Users may be prompted to select their account (prompt=select_account)
Shapes reads only:
- User's name
- User Principal Name (UPN / email)

Important:

No Microsoft Graph permissions are requested
No admin consent is required for additional data access

Google Workspace