Security: MFA & SSO

Protect console access with TOTP multi-factor authentication and SAML single sign-on.

Multi-factor authentication (TOTP)

Each member enables MFA from their own profile (Account → Security → Two-factor authentication). Org admins can see whether a member has MFA enabled in the team list.

1. Enroll — click Set up authenticator, scan the QR code with any TOTP app (Google Authenticator, Authy, 1Password…), and save the recovery codes.
2. Activate — enter a one-time code from the app to confirm enrollment.
3. Sign-in — after the Google sign-in step, the console challenges for the current TOTP code.
4. Remove — go to the same screen and click Remove (requires a current TOTP code to confirm).

SAML single sign-on

SAML SSO is configured at the org level by an ADMIN or OWNER. Your identity provider can only sign in people whose email is on a domain your organization has verified — a signature from your IdP alone is never enough, so no organization's IdP can vouch for anyone else's users.

1. Go to SSO / SAML → Email domains in the console and add your domain (for example acme.com). Shared mailbox providers such as gmail.com can't be added.
2. Publish the TXT record it shows — name _croombit.acme.com, value croombit-verify=… — at your DNS provider, then press Verify. A domain can be verified by only one organization.
3. In Identity provider, paste your IdP's metadata XML or metadata URL.
4. Register Croombit as a Service Provider in your IdP using the details below.
5. Choose the role given to people added automatically on their first SSO sign-in (Viewer by default; never Owner).
6. Save and test with a non-owner account before enforcing SSO.