> ## Documentation Index
> Fetch the complete documentation index at: https://absentify.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication settings

> Choose how users sign in to absentify and decide whether other Microsoft 365 users from your company can spin up their own workspaces.

The **Authentication** page is where administrators decide:

1. **Which sign-in methods are allowed** — Microsoft 365 only, or Microsoft 365 *and* email-based "Magic Link" sign-in.
2. **Whether other Microsoft 365 users from your company are allowed to create their own absentify workspaces** — only relevant if you've restricted sign-in to Microsoft only.

In the app sidebar, this page lives in the **General** group, directly below [Privacy](/docs/en/roles/hr_admins/settings/general/privacy). Only administrators can change these settings.

<Note>
  **A few terms used on this page**

  * **Microsoft 365 sign-in** — your team signs in with the same work account they use for Outlook, Teams, OneDrive, etc. (sometimes called a "Microsoft work or school account").
  * **Magic Link** — instead of a password, the user types their email address and absentify emails them a one-time login code, valid for 60 minutes. They enter the code on the sign-in page. Outside Microsoft Teams, the same email also contains a button that signs them in directly.
  * **Microsoft tenant** — Microsoft's word for "your company" inside Microsoft 365. When your IT department set up Microsoft 365 (e.g. `@yourcompany.com`), Microsoft created a tenant for you. Everyone with a `@yourcompany.com` work account belongs to the same tenant.
</Note>

***

## Allowed sign-in methods

Open the **Allowed sign-in methods** dropdown to select between two options.

### Microsoft only

Only Microsoft 365 sign-in is allowed. This is the recommended choice for organizations that want the full Microsoft experience.

* Recommended for production use with the full Microsoft 365 experience.
* Enables automatic Outlook calendar sync and out-of-office replies.
* Anyone without a working Microsoft 365 account cannot sign in.
* Newly invited users have to sign in with Microsoft.
* A user who previously signed in with an email code can select **Login with your Microsoft account**. absentify links the account automatically. If Microsoft cannot match the account, the user sees **Sign in with an email code** instead. That happens when they sign in with a guest Microsoft account that does not use the invited email.

**Important things to know**

<AccordionGroup>
  <Accordion title="You can't switch to Microsoft only while users still sign in with Magic Link">
    If any active user still signs in via Magic Link and hasn't linked a Microsoft account, absentify shows a red warning with the number of affected users and refuses to save the change. Select **View affected users** in the warning to open a list showing every affected person's name and email so you know exactly who still needs to link their Microsoft account. To switch:

    1. Each affected user selects **Login with your Microsoft account**. absentify links the account automatically. They can also open their [personal sign-in settings](/docs/en/roles/employee/sign_in#switching-sign-in-methods) and select **Link Microsoft account**.
    2. Once nobody is left on Magic Link, you can save the change.

    If a user can't link Microsoft (for example, because they don't have a Microsoft 365 account at all), they'll lose access the moment you switch. Make sure everybody is set before flipping the switch.
  </Accordion>

  <Accordion title={`"Microsoft only" doesn't grant Microsoft permissions on its own`}>
    Selecting **Microsoft only** only controls *who can sign in*. It does **not** automatically give absentify permission to read calendars, send out-of-office replies, or sync Teams groups.

    To unlock those advanced features, your IT department still needs to grant the matching permissions in Microsoft 365. See [Microsoft Integration](/docs/en/roles/m365admins/getting_started/microsoft_account_integration) for the full permission walkthrough, plus dedicated guides for [Calendar synchronization](/docs/en/roles/m365admins/permissions/outlook_calendar_synchronization) and [Automatic out-of-office replies](/docs/en/roles/m365admins/permissions/outlook_out_of_office_reply).
  </Accordion>

  <Accordion title="Users with non-Microsoft email addresses lose access">
    If someone signs in via Magic Link because they don't have a Microsoft 365 account (e.g. a freelancer with a Gmail address), they have no way to sign in once you restrict the workspace to **Microsoft only**. Make sure every user has a valid Microsoft 365 account first.
  </Accordion>
</AccordionGroup>

### Both (Microsoft & Magic Link)

Users can sign in either with their Microsoft 365 account *or* with a Magic Link sent to their email.

* Maximum flexibility. Works for companies whose team members don't all have Microsoft 365.
* A user who first signed in with an email code can later sign in with Microsoft. absentify links the account automatically.
* A good fit for trial periods or mixed setups.

**Important things to know**

<AccordionGroup>
  <Accordion title="Magic Link users miss out on Microsoft-only features">
    The following features rely on Microsoft 365 sign-in. Users who sign in with Magic Link won't have them:

    * Automatic personal Outlook calendar synchronization. If **Calendar invitations** are enabled for the user and the leave type allows an entry, a current or future request action can send an iCal email instead. Turning invitations on does not by itself send first invitations for existing absences, and a first invitation is not sent for an absence that has already ended. See [Your preferences](/docs/en/roles/employee/your_preferences#notification-settings).
    * Automatic sync of public holidays into the Outlook calendar.
    * Automatic Outlook out-of-office replies.
    * Automatic sync with Microsoft Teams and Microsoft 365 groups (Microsoft's user directory, sometimes called Entra ID).
    * Automatic manager and reporting-line sync from Microsoft 365.
    * Group calendar and public-holiday sync.
    * Automatic absence sync to timeghost.
    * Azure AI integration.
  </Accordion>

  <Accordion title="Other users from your company can create their own workspaces">
    While **Both (Microsoft & Magic Link)** is selected, anyone from your Microsoft tenant — or with the same email domain — can sign up at [app.absentify.com](https://app.absentify.com). They will create their own separate workspace instead of joining yours. absentify shows an inline hint under the dropdown explaining this. To prevent it, switch to **Microsoft only** and turn on the toggle described in [Prevent workspace creation for same tenant](#prevent-workspace-creation-for-same-tenant).
  </Accordion>
</AccordionGroup>

### Recommended rollout

A common path looks like this:

1. **Trial:** Start with **Both (Microsoft & Magic Link)** so colleagues can try absentify without involving IT.
2. **IT approval:** Get the Microsoft 365 integration approved by your IT department.
3. **Production:** Switch to **Microsoft only** to unlock the full automation.
4. **Migration:** Anyone still on Magic Link selects **Login with your Microsoft account**. absentify links the account automatically. This still works after you switch to **Microsoft only**. Linking in [personal sign-in settings](/docs/en/roles/employee/sign_in#switching-sign-in-methods) is only available while the workspace still allows both methods.

***

## Prevent workspace creation for same tenant

This toggle controls whether other users from your Microsoft tenant — i.e. colleagues with `@yourcompany.com` work accounts — can create *their own* absentify workspace, separate from yours.

The toggle is **only visible when "Microsoft only" is the selected sign-in method**. With **Both (Microsoft & Magic Link)** selected, sign-in isn't tied to a Microsoft tenant in the first place, so this restriction has no effect and the toggle is hidden.

* **Enabled** — Users from your tenant must be invited into the existing workspace. They will not see an option to create a new workspace when they sign in. This is the right choice when you want all users from the same Microsoft 365 organization to land in one shared workspace, with no accidental duplicates.

  <Info>
    If other workspaces from your organization already exist, absentify will ask you to resolve those conflicts first before you can turn this toggle on.
  </Info>

* **Disabled** — Anyone from your Microsoft tenant who isn't yet part of your workspace can visit [app.absentify.com](https://app.absentify.com), sign in, and choose between joining an existing workspace or creating a new one.

  <Tip>
    If you leave this disabled, send your team [this guide](/docs/en/roles/employee/sign_in#welcome-page-with-options) before inviting them so they don't accidentally create a parallel workspace.
  </Tip>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.