Skip to main content

Setting up SSO in Shapes

Written by Efrat Barak Zadok

How to connect:

  1. Click on the 3 dots in the right hand corner, then click on Account settings:

    Shapes menu showing the 3 dots option expanded with Account settings highlighted

  2. Click into the Security tab and select SSO:

    (Make sure to mark the checkbox by Google SSO or Microsoft SSO)

    Shapes Account Settings Security tab with SSO option and Google/Microsoft SSO checkboxes

Multi-SSO Support

Shapes accounts support connections to multiple SSO domains. Organizations utilizing more than one identity provider or managing multiple domains can streamline their authentication process.

  • Google SSO

  • Microsoft SSO

Both Google and Microsoft SSO connections can be active simultaneously. To configure, go to Account Settings → Security → SSO and add your SSO domains.

Security and Access Control

  • Adding a domain enforces SSO for that domain immediately and account-wide. There is no staged rollout and no way to require it for some users on the domain but not others.

  • Shapes has no native two-factor authentication setting. Multi-factor authentication is enforced at your identity provider — for example, Conditional Access in Microsoft Entra — and Shapes inherits whatever the provider requires at login.

  • Disabling a user at your identity provider blocks new logins, but it does not end a Shapes session that is already active. Offboarding a user has to also deactivate or terminate them inside Shapes.

  • The in-platform Activity Log covers changes to employee data. It does not cover account-level security events such as SSO configuration or domain changes.

Overview

Shapes uses OpenID Connect (OIDC) for authentication. We only request the minimum set of standard scopes required to identify a user:

  • Name

  • Email address

We do not request access to any sensitive or extended data such as:

  • Emails or mailboxes

  • Calendars

  • Files or drives

  • Directory data beyond basic profile

Required Scopes by Provider

Microsoft Entra ID (Azure AD)

Scopes required:

  • openid

  • profile

Details:

Important:

  • No Microsoft Graph permissions are requested

  • No admin consent is required for additional data access

Google Workspace

Scopes required:

  • openid

  • profile

  • email

Details:

  • Uses OAuth 2.0 Authorization Code flow

  • Shapes verifies the id_token and reads:

    • Email address

    • First name (given_name)

    • Last name (family_name)

Did this answer your question?