How people sign in.
WHAT THE BASELINE IS
Email and password, with a reset flow that is secure.
WHAT TO ADD EARLY
Two-factor authentication, available to everyone.
WHAT SOCIAL SIGN-IN PROVIDES
Faster signup, and no password to manage.
WHAT IT COSTS
Dependence on a provider, and complications if a customer leaves that provider.
WHAT TO ALWAYS SUPPORT ALONGSIDE
A direct route, so the account is not trapped.
WHAT LARGER CUSTOMERS REQUIRE
Sign-on through their own identity provider.
WHY THEY REQUIRE IT
It lets them control access centrally and remove it immediately.
WHAT THAT MEANS COMMERCIALLY
It is frequently a condition of the deal, not a preference.
WHAT AUTOMATIC PROVISIONING ADDS
Accounts created and removed by the customer's system.
WHY THAT MATTERS TO THEM
Departed staff lose access without anyone remembering.
WHAT TO BE CAREFUL WITH
Sessions surviving after access is revoked Password reset bypassing the identity provider
WHY THAT SECOND POINT
It defeats the control entirely, and auditors check it.
WHAT TO BUILD
The ability to require a single sign-in method per organisation.
WHAT TO LOG
Every sign-in, with location and device.
WHAT TO NOTIFY ON
Sign-in from a new device.
