Enterprise SSO onboarding

When your company connects its identity provider (IdP) to FranchiseSEE, the people you give access fall into two groups:

• Corporate-email users sign in with an address on your company's own domain.
• Personal-email users sign in with any other address, such as a franchisee's own Gmail account.

For both, the first step is the same: grant the user access to FranchiseSEE in your company's IdP.

Corporate-email users#

Corporate-email users get full single sign-on. When they sign in to FranchiseSEE, they are sent to your company's own login page, and come back signed in.

There are two ways to set up their permissions:

• Invite them first (recommended). Invite the user from the FranchiseSEE admin before their first sign-in, and choose their permissions there. They arrive with the right access from their first sign-in.
• Let them sign in first. A user who signs in without an invitation gets an account with no permissions, so they can't see any data yet. FranchiseSEE emails your corporate helpdesk with instructions for assigning their permissions in the FranchiseSEE admin.

Personal-email users#

Personal-email users can't use your enterprise SSO directly, because their address isn't on your company's domain.

1. Grant them access in your IdP.
2. Invite them from the FranchiseSEE admin, choosing their permissions.
3. On their first sign-in, they set a FranchiseSEE password.

Their FranchiseSEE account is deleted automatically when you revoke their access in your IdP. You don't need to remove them in FranchiseSEE separately.

Choosing permissions#

Whichever way a user arrives, their access to locations follows the user access model: an HQ user sees the whole brand, and a franchisee sees either one location or the locations in their location groups.