Members and access

Getting people in

People join an organization one of three ways: you invite them, they sign in through your identity provider, or they join automatically because their email is on a domain you have verified.

Invitations are managed at the organization, and membership is granted per scope, so inviting someone is two decisions: let them in, and decide what they get access to. See roles and permissions for the second.

Verified domains

Verifying a domain lets anyone with an email address on it join without an individual invitation.

You add the domain, publish the DNS record Taiga gives you, and then verify it. The DNS step is the point: it proves you control the domain, which is what stops someone else claiming your company’s email addresses.

Weigh it before turning it on. For a company where everyone with a work address should have access, it removes an administrative queue. For one where access is deliberately narrower than the payroll, invitations are the right mechanism and domain join is a hole in it.

Single sign-on

Taiga supports single sign-on with Microsoft Entra ID. Connecting it takes your Azure directory (tenant) ID, and from then on your users can sign in with the accounts they already have.

Connecting SSO does not by itself close the other doors.

Require SSO does. It blocks password sign-in for the organization, so every member authenticates through your identity provider and nobody keeps a separate password to Taiga.

Enable it once you have confirmed SSO works, in that order. Turning it on before the connection is verified is how administrators lock themselves out.

Members of an SSO-enforced organization see a sign-in page that offers only that route, and are told plainly that their organization requires it rather than being left to work out why their password stopped working.

Two-factor authentication

You can require two-factor authentication for everyone in the organization.

The decision that matters is the rollout, not the requirement. You can enforce it immediately, or give members a window of a week, a fortnight or a month to set it up.

Immediate enforcement locks out everyone who has not already enrolled, which on a working day means everyone. A window lets people enroll on their own time and still ends with the same policy. Choose immediate only when you are responding to something.

Accounts that authenticate through your identity provider delegate this to it. Taiga does not ask a federated user to enroll separately, because the check has already happened and asking twice would be theatre. Enforcement applies to accounts with a password managed in Taiga.

Members enroll from their own account settings.

Sessions

You set a maximum session length for the organization: how long someone can stay signed in before they have to authenticate again.

This is the control that turns an unattended laptop from an indefinite problem into a bounded one. Pick the shortest length your people will tolerate.

You can also sign a specific user out of all their sessions immediately. That is the right response to a lost device or a departure that needs to take effect now rather than at the next expiry.

Removing access

Removing someone’s membership removes their access to what it granted. If they had roles at several scopes, each is its own grant.

For a departure, sign the user out of all sessions as well. Removing membership stops new authorization; it is ending the live session that makes the removal immediate.