Can our team sign in with our company login?

Single sign-on means your people use the login they already have — Microsoft, Google Workspace, Okta, or any identity provider that speaks SAML 2.0 — instead of a separate password here. On the sign-in screen they choose Sign in with your company, type their work email, and are sent to your company's login and straight back in. Your IT team keeps the keys: when someone leaves the firm and their company login is switched off, they cannot get in here either.

To ask for it, your organization's administrator opens Settings → Security & two-factor, names your firm's email domains and pastes the metadata URL from the application your IT team creates for Veristep in your identity provider. Each domain then shows a short DNS record to add, one TXT record per domain; whoever runs your firm's DNS adds it, and you press Check now. That proves the domain is yours, and single sign-on can't be turned on until every domain shows Proven. A person from Veristep then sets it up with your provider and confirms by email. Your firm's own domains only — a personal mail domain is refused, because single sign-on is for a firm's address book, not for everyone who happens to use the same mail service.

Single sign-on signs people in; it does not add them. Your administrator still adds each person under People & access first, with the role they should have; their invitation email tells them to sign in with your company, and no separate password is made for them. Someone from your domain who has not been added can prove who they are and will still find no organization waiting — which is exactly right. Who a person is and what they may do are two different questions, and the second one stays with you.