Hosted SSO & Email Delivery

Configure Microsoft Entra ID or Google Workspace SSO, auto-join, and send workspace emails from your own domain on hosted Pro plans.

This article applies to: Hosted (Pro and Pro (Legacy))

Overview

Yes — managed (hosted) workspaces can use Microsoft Entra ID SSO, automatically join users to the workspace, and send notification email from your own domain.

These features are available on hosted Pro and Pro (Legacy) plans at pwpush.com (US or EU). They are not included on Free or Premium.

Capability What it does
Custom SSO Members sign in on your workspace’s custom domain with Microsoft Entra ID or Google Workspace
Auto-join via SSO First successful SSO sign-in can add the user as a workspace Member (optional; domain allowlist + seat limits apply)
Require SSO Disable username/password login so members must use your IdP
Custom email delivery Send Auto-Dispatch, OTP/challenge, and invitation mail through your Google Workspace or Microsoft 365 mailbox

Self-Hosted Pro configures SSO differently (instance-wide in Admin → Settings → Auth, more IdPs including Okta and Keycloak). See Pro Self-Hosted Configuration.

Prerequisites

  1. An active Pro or Pro (Legacy) subscription on us.pwpush.com or eu.pwpush.com — see Regions.
  2. An active custom domain on the workspace (setup guide). SSO buttons appear on the branded custom-domain sign-in page.
  3. Workspace Admin access (only admins can edit SSO and Email Delivery policy).

Where to configure

  1. Open your team workspace (workspace switcher, top-left).
  2. Go to Admin → Application Policies.
  3. Under Security, open:
    • Single Sign-On — IdP credentials, auto-join, password login
    • Email Delivery — Google Workspace / Microsoft 365 sending

Single Sign-On

Hosted custom SSO uses your OAuth app in Google or Microsoft. Password Pusher stores Client ID / Client secret per workspace and completes the OAuth handshake on the regional core host (us.pwpush.com or eu.pwpush.com), then returns the user to your custom domain.

Supported providers on hosted:

Provider Typical use
Microsoft Entra ID Microsoft 365 / Azure AD organizations
Google Workspace Google Workspace organizations

Okta, Auth0, Keycloak, NetScaler, and custom OAuth2 are available on Self-Hosted Pro, not on hosted Pro.

Microsoft Entra ID (Azure AD)

1. Create an app registration

  1. In Azure Portal, open Microsoft Entra ID → App registrations → New registration.
  2. Name: e.g. Password Pusher or your workspace name.
  3. Supported account types:
    • Accounts in this organizational directory only — single-tenant; you must enter Tenant ID in Password Pusher.
    • Accounts in any organizational directory — multi-tenant; leave Tenant ID blank in Password Pusher.
  4. Leave Redirect URI blank for now → Register.

2. Add a Web redirect URI (required)

Password Pusher is a confidential web app. Use a Web platform and a client secret. Do not register only as a single-page or public client (that can cause AADSTS700025).

  1. App registration → Authentication → Add a platform → Web.
  2. Redirect URI — use your region’s core host, not your custom domain:
Region Redirect URI
US https://us.pwpush.com/users/auth/microsoft_graph/callback
EU https://eu.pwpush.com/users/auth/microsoft_graph/callback

The exact URI is also shown in Application Policies → Single Sign-On under the Microsoft Entra ID card.

  1. Set Allow public client flows to No → Configure.

Important: Unlike Self-Hosted Pro (where the callback is https://<your-domain>/users/auth/microsoft_graph/callback), hosted OAuth always completes on us.pwpush.com or eu.pwpush.com. Registering only your custom domain will break sign-in.

3. Create a client secret

  1. Certificates & secrets → New client secret.
  2. Copy the Value immediately (shown once). That is the Client secret in Password Pusher.

4. Copy IDs

On the app registration Overview page:

  • Application (client) ID → Client ID
  • Directory (tenant) ID → Tenant ID (single-tenant apps only; GUID or domain such as contoso.onmicrosoft.com)

5. Enter values in Password Pusher

  1. Admin → Application Policies → Single Sign-On → Edit.
  2. Enable Microsoft Entra ID and paste Client ID, Client secret, and Tenant ID (if single-tenant).
  3. Save Single Sign-On.

6. Sign in

Open your custom domain sign-in page (e.g. https://secure.example.com). You should see Sign in with Microsoft Entra ID. After a successful IdP login, users return to the workspace on that custom domain.

Google Workspace

  1. In Google Cloud Console, create an OAuth client of type Web application.
  2. Add the authorized redirect URI for your region:
Region Redirect URI
US https://us.pwpush.com/users/auth/google_oauth2/callback
EU https://eu.pwpush.com/users/auth/google_oauth2/callback
  1. Copy the Client ID and Client secret into Application Policies → Single Sign-On → Google Workspace.
  2. Enable the provider and save.

Auto-join via SSO

When Auto-join via SSO is enabled, a user who successfully signs in through your configured IdP is added to the workspace as a Member on first login (if they are not already a member).

When disabled, only existing members (and users with a pending invitation) can sign in via SSO. Others see an access-denied message asking them to contact an administrator.

Auto-join allowed email domains

Optional allowlist (comma or space separated), e.g. example.com acme.org:

  • Leave blank to allow any email the IdP authenticates (your IdP still controls who can sign in).
  • When set, only emails on those domains (and their subdomains, e.g. eu.example.com for example.com) may auto-join.
  • Existing members can still sign in even if their domain is not on the allowlist.

Seats

Auto-join respects your purchased seat count. If the workspace is at capacity, sign-in is refused with a seats message. Admins can buy more seats from billing. Unlimited / flat-fee Pro plans without a seat cap are not blocked by this check.

Identity checks

Auto-join requires a present email from the IdP. If the IdP asserts the email is not verified (e.g. Google email_verified: false), auto-join is skipped. Microsoft Entra ID organizational identities are trusted after a successful handshake when no explicit “unverified” claim is present.

Require SSO (disable password login)

  1. Configure and enable at least one SSO provider.
  2. Turn off Allow Username & Password Login.
  3. Save.

Members must then use SSO on the custom-domain sign-in page. You cannot disable password login until at least one provider is fully configured (prevents lockout).

2FA policy and SSO

If the workspace Require Two-Factor Authentication policy is on, members must still enable 2FA under Password & 2FA in Password Pusher. IdP MFA alone does not satisfy that policy. See Hosted Pro — 2FA policy.

SSO troubleshooting

Symptom What to check
No SSO buttons Custom domain active? Pro or Pro (Legacy) plan? Provider enabled with Client ID/secret? Visit the custom domain, not only the core host.
Redirect / AADSTS errors after Microsoft login Redirect URI must be the regional core callback (us or eu), Web platform, confidential client. Single-tenant apps need Tenant ID.
“Something went wrong” Generic UI message by design; contact support with approximate time and user email so logs can be checked.
Access denied / contact administrator Auto-join off, domain not allowlisted, or no seats — invite the user or adjust policy / seats.
“We already have an account with this email…” Link accounts: see FAQ.

For multi-domain Entra tenants and the xms_edov claim, the same guidance as Self-Hosted applies: Microsoft Entra ID and domain verification.

Custom email delivery

Connect a Google Workspace or Microsoft 365 mailbox so recipient-facing workspace mail is sent from your address instead of the platform default.

What is routed

Sent through your connected provider when Email Delivery is active:

  • Auto-Dispatch / notify-by-email for pushes
  • Secure request notification emails
  • Recipient OTP / challenge emails
  • Workspace invitation emails

Still sent by the platform (not rewritten): account/Devise mail, billing, admin notices, and similar system mail.

Where to configure

Admin → Application Policies → Email Delivery → Edit.

Microsoft 365 setup

  1. Create an Entra App registration (can be separate from the SSO app).
  2. Add a Web redirect URI for your region:
Region Redirect URI
US https://us.pwpush.com/email_oauth/callback
EU https://eu.pwpush.com/email_oauth/callback
  1. Create a client secret; note Client ID and Tenant ID (single-tenant).
  2. Under API permissions, add Microsoft Graph delegated permissions:
    • Mail.Send
    • User.Read
    • offline_access / openid as prompted
  3. Grant admin consent if your tenant requires it.
  4. In Password Pusher, enable Microsoft 365, paste credentials, optional Sender address, and Save.
  5. Click Connect and sign in with the mailbox that will send mail (or that may send as the configured sender).
  6. Optionally Send test to verify.

Google Workspace setup

  1. In Google Cloud Console, create an OAuth Web application client.
  2. Add the same regional redirect URI: https://us.pwpush.com/email_oauth/callback or https://eu.pwpush.com/email_oauth/callback.
  3. Enable the Gmail API for the project. Scopes used: gmail.send and userinfo.email.
  4. Paste Client ID / secret in Password Pusher, save, then Connect with the sending mailbox.

Sender address

Optional Sender address must be the connected mailbox or an address that mailbox is allowed to send as. If blank, mail is sent as the connected account.

Disconnect

Disconnect clears the OAuth connection; workspace mail reverts to the platform sender until you connect again.

Hosted vs Self-Hosted SSO

  Hosted Pro Self-Hosted Pro
Where configured Workspace Application Policies → Single Sign-On Instance Admin → Settings → Auth
Providers Google Workspace, Microsoft Entra ID Google, Microsoft, Okta, Auth0, NetScaler, Keycloak, and more
OAuth redirect URI Regional core host (us / eu.pwpush.com) Your instance hostname
Auto-join Per-workspace policy + domain allowlist + seats Instance user creation via IdP (no hosted seat model)
Custom email from your domain Email Delivery policy (Gmail / Graph OAuth) Configure SMTP in Admin Settings

See also