Sign-in, SSO & directory sync
Callstrike sign-in supports three things: email sign-in for admins and learners, per-workspace SSO so your identity provider (Okta, Microsoft Entra ID, Google, and others) owns login for its users, and directory sync so your training targets stay in step with your HR or IT directory automatically. Each workspace has its own SSO connection and its own directory connection; everything is scoped to that workspace.
Prerequisites
- A workspace. Every workspace created going forward is ready for sign-in automatically.
- To set up SSO: admin access to Settings, plus at least one verified domain for the workspace (Settings → Verified Domains & Email Delivery). SSO setup is gated on this: Callstrike proves domain ownership itself (DNS TXT record, email to a role address, or manual approval).
- To connect a directory: admin access to Settings → Workforce. There is no verified-domain gate; directory sync doesn't route on domain ownership.
How to use it
Signing in
- Enter your work email on the login page. Callstrike checks whether that email's domain has an active SSO connection first, if it does, you're sent straight to your identity provider; otherwise you get a 6-digit code by email to enter and continue.
- Social sign-in (Continue with Google / Microsoft / Slack) is also available.
- If your email belongs to more than one workspace, you'll see a "Choose a workspace" picker before you land in the app.
- Admins who belong to multiple workspaces can switch between them from the sidebar workspace switcher; this re-mints your session for the other workspace without a page redirect.
Setting up SSO for your workspace
- Go to Settings → Single Sign On.
- Verify at least one domain on the Domain sub-tab if you haven't already (the Set up SSO button stays disabled with a tooltip until you have).
- Switch to the SSO sub-tab and click Set up SSO (or Manage SSO once a connection exists). This opens a guided setup portal, scoped to your workspace.
- Configure the SAML or OIDC connection with your identity provider in the portal. Once it's active, logins for your domain route through it automatically; there's no separate "SSO login" option to enable.
Connecting a directory
- Go to Settings → Workforce.
- Click Connect directory (or Manage directory once one exists) to open the guided setup portal for your directory connection (Okta, Entra ID, Google Workspace, JumpCloud, OneLogin, Rippling, Workday/BambooHR, or generic SCIM).
- Once connected, directory users appear as Training Targets. Additions, updates, and removals sync in near real time, and a nightly reconcile backfills anything a missed update would otherwise drop.
Configuration & options
| Option | What it does | Default | Notes |
|---|---|---|---|
| Verified domain | Gates whether Set up SSO is enabled | Required (≥1) | Domain verification is handled by Callstrike |
| SSO connection | Per-workspace SAML/OIDC connection, configured in the guided setup portal | None | Status shows as active / setup in progress / no SSO connection yet in Settings |
| Directory connection | Per-workspace directory (SCIM/HRIS/IdP), configured in the guided setup portal | None | Status shows as connected / setup in progress / no directory connected yet |
| Phone attribute mapping | Directory sync reads the phone number from whichever phone field your directory provides | None | Most directories don't carry phone as a standard field; if it isn't present, the synced target has no phone |
| License seat cap | Caps how many synced targets can be active at once, equal to the workspace's purchased seats | Count of the workspace's seats | Deterministic ordering: manually activated targets first, then oldest-synced first; excess targets stay inactive, not deleted |
Gotchas & limitations
- New directory users start inactive. A person appearing in your directory doesn't automatically become an active training target; they're created inactive and only promoted into an active seat as capacity allows (manual activations first, then oldest-synced). Don't expect a fresh sync to activate everyone at once if you have fewer seats than directory users.
- Admin edits to a synced target are protected from being overwritten. Editing a synced Training Target's first/last name, phone, or Slack ID marks that field as admin-owned; the next directory sync will not clobber it. Use Revert to directory sync on the target's detail drawer if you want sync to manage that field again.
- Deleted or GDPR-erased targets are never recreated by a later sync. A suppression record is kept so a re-sync of the same directory user doesn't bring them back. A genuinely new person with a different identity still syncs in normally.
- A directory removal deactivates; it doesn't delete. Removing a person from the directory flips the target to inactive (a reversible state) rather than hard-deleting them.
- Directory groups aren't mapped yet. Group membership and directory lifecycle changes are acknowledged but not acted on today; there's no directory-group to Callstrike-group mapping.
- Slack workforce sync is a separate path. Slack isn't a directory-sync provider, so Slack-connected teams sync through the Slack integration (Settings → Workforce also surfaces Slack/Microsoft connect where applicable) rather than through directory sync.
- Admin and superadmin are Callstrike-side roles, not directory roles. Roles from your identity provider are never used to grant Callstrike admin or superadmin; an identity becomes an admin only by being added to the workspace's admins, and superadmin only via the internal allowlist.
- An identity unknown to the resolved workspace is rejected, not auto-provisioned. If your session's workspace doesn't recognise you as an admin or an employee in that workspace, sign-in fails rather than silently creating an account.
Best practices
- Verify a domain before attempting SSO setup, the Set up SSO button is disabled until you do, so do the domain step first to avoid a dead click.
- After connecting a directory, check the Training Targets list for anyone stuck inactive; it usually means you're at your seat cap, not that sync failed.
- If you need to hand-correct a synced target's phone number permanently, edit it directly rather than fighting the next sync; the edit is respected going forward until you explicitly revert it.
Troubleshooting / FAQ
A directory user I deleted (or erased for GDPR) keeps showing up as "new", is sync broken? No. Check whether it's actually the same person recreated (it shouldn't be; deleted or erased identities are suppressed from re-creation) versus a different person with a new directory identity, which is expected to sync in as new.
I connected a directory but nobody became an active training target. New directory users default to inactive. They're promoted into active seats up to your workspace's license cap, in a fixed order (manual activations first, then oldest-synced); check your seat count if it looks stuck.
Why didn't my edit to a synced target's phone number survive the next sync? It should, an admin edit protects that field from being overwritten. If it reverted, confirm the edit actually saved (and wasn't cleared via "Revert to directory sync," which intentionally hands the field back to sync).