Sign-in with a code, passkeys and single sign-on
Every employee and manager has their own login and works on their own records. In the app they can sign in with a one-time code by WhatsApp or SMS, or with a passkey. On the web they use a password, a passkey or your Microsoft or Google account. Leavers' accounts are switched off.
PLANSEvery plan
Built. Single sign-on is not yet tried on a customer's Microsoft or Google directory. Codes by WhatsApp and SMS are not yet tried with a customer. The app is not in the app stores yet.
The problem it solves
- Shop-floor staff forget passwords, and HR spends the morning resetting them.
- Staff share one login, so nobody knows who applied or approved what.
- People already sign in to Microsoft 365 or Google Workspace and do not want one more password.
- Someone leaves, and their account here keeps working for weeks.
How it works
- HR opens the employee and presses Create User. A plain login is made for the employee's entity, usually their work email, and the invitation to set a password goes out.
- To allow codes in the app, HR switches on Sign-in by Code in the HRMS App for the entity. HR also chooses how the code is sent.
- In the SmartMy HRMS app the employee taps Sign in with a code and types the mobile number on their employee record. Then they type the 6-digit code.
- Anyone can add a passkey: Face ID, fingerprint, the phone or a security key. They then sign in with it on the web or in the app.
- With single sign-on, IT adds Microsoft (Entra ID), Google Workspace or another OpenID Connect provider. People press Sign in with Microsoft or Google on the web.
- Directory sync switches a login off here when the account is disabled there. When HR relieves an employee, IT is asked to disable their Microsoft or Google account.
Everything it does
Own login for each person
- Create User on the employee: HR of that entity makes a plain internal login, no administrator needed
- Login usually the work email; Send the Invitation on by default
- One login per person, so every request, approval and change carries their name
- Employees see their own records; managers see their team (see Who sees what)
Sign-in with a code, in the app
- Off until HR switches it on, per entity
- Send the Code By: WhatsApp, else SMS (the default); only SMS; only WhatsApp
- Code Valid For: 5 minutes by default; 6 digits; works once
- Five wrong codes end it; at most one code a minute and five an hour
- The number must belong to one employee only (mobile or work phone), matched on its last 10 digits
- The app answers the same whether or not the number is known, so nobody can find out who works here
- Codes are sent from the WhatsApp or SMS message credits
Passkeys
- Sign in with a passkey on the web login and in the SmartMy HRMS app
- The passkey prompt shows your workspace's name
- In the app, the passkey is asked in the phone's browser, which hands back a one-time code valid for 2 minutes
- Add a passkey from your profile on the web, or from the app
- The password keeps working next to it
Single sign-on
- Providers: Microsoft (Entra ID), Google Workspace, or another OpenID Connect provider, per entity
- Allowed email domains: only those you list, or any
- A first sign-in finds the user by email and links them, or accepts only users already linked
- Single Sign-On Only: linked staff can no longer use a password; administrators keep theirs
- Every sign-in, refusal, link, activation and deactivation is in the Sign-in and Directory Log
Directory sync and leavers
- Microsoft and Google sync every hour, and at once with change notifications
- An account disabled, suspended or deleted there switches the login off here
- Optional: create users from the directory and update their names
- Microsoft can also send accounts by SCIM provisioning
- Disable Directory Accounts of Leavers: when an employee is relieved, a request waits for IT in Account Deactivations
- IT presses Disable the Account or Keep the Account; after the last level the directory account and the login here are switched off
Who uses it
Employee and managerSigns in with their own login, a code in the app, a passkey or their work account.
HR officer or HR administratorCreates logins from the employee record and switches on sign-in with a code.
Single Sign-On IT AdministratorAdds providers, runs directory sync and decides account deactivations of leavers.
Where you use it
- Web: the employee record, Create User; Administration > Users & Entities > Entities > the Entity (HRMS App Sign-in, Single Sign-On tab)
- Web: Settings > Single Sign-On (Sign-in Providers, Account Deactivations, Sign-in and Directory Log, Approval Chains)
- The SmartMy HRMS app: Sign in with a code and Sign in with a passkey on the login screen. The app is built and in testing, not in the app stores yet
- Not in the HRMS app yet: Sign in with Microsoft or Google; use the web, a code or a passkey
- Not on the web: sign-in with a code is for the app only
What you control
Settings
- Sign-in by Code in the HRMS App: off, per entity
- Send the Code By: WhatsApp, else SMS
- Code Valid For (minutes): 5
- Single Sign-On Only: off, per entity
- Disable Directory Accounts of Leavers: off, per entity
- Create and update users from the directory: off
Approvals
- Account Deactivation: one chain per entity; the Single Sign-On IT Administrators to start with, with levels you add. Nobody decides the deactivation of their own account.
Notifications
- HRMS App Sign-in Code: to the employee, by WhatsApp or SMS as the entity chose; sent at once
- The invitation to set a password: by email, when HR creates the login
Questions
Do employees need an email address to sign in?
A login is needed for each person, usually the work email. In the app they can then sign in with a code sent to the mobile number on their employee record, without typing a password.What if two employees share one phone number?
Sign-in with a code needs the number on one employee only. HR fixes the employee records; until then those people sign in with a password or a passkey.Can we stop people using passwords?
Yes, with single sign-on. Tick Single Sign-On Only on the entity and linked staff must sign in with their Microsoft or Google account. Administrators keep their password.What happens to the login when someone leaves?
If the account is disabled in Microsoft or Google, sync switches the login off here within the hour. With Disable Directory Accounts of Leavers on, relieving the employee asks IT to disable the directory account too.Can people use single sign-on in the phone app?
Not yet in the SmartMy HRMS app. In the app they sign in with a password, a code or a passkey; single sign-on is on the web.Related features
ROLES AND ACCESSWho sees what: employees, managers and HR officersEach employee sees only their own records and each manager sees everyone below them. HR staff get roles per Entity, limited to some departments or locations if you wish. A role can also hide parts of the record, such as bank details.SELF-SERVICE AND APPPhone app for employees, managers and HROne SmartMy HRMS app for everyone: employees check in, apply for leave and see payslips. Managers approve and see their team, and HR and payroll do their daily work. The server decides what each person sees, by the same access as the web.EXITResignation, exit interviews and clearanceAn employee resigns, or HR records a termination, retirement or other separation. The notice comes from your policy, the manager and HR approve, every department clears the leaver, and the exit interview is on record.ENGAGEMENT, GOALS AND HR TOOLSAPI and webhooksYour own systems read employees, attendance, leave and payroll results with API keys that have scopes. They are told at once when an employee joins, changes or leaves, a leave or payslip is approved, or a resignation is sent.ACROSS SMARTMY HRMSApproval chains and one approvals inboxEvery HR request, from a day's leave to the full and final, goes through its approval chain and waits in one Approvals inbox. Levels, approvers, reminders, escalation and stand-ins are settings you control, per Entity and kind of request.
See your own month run in it.
Tell us how many people you have, how you take attendance and how your salary is structured. We will show you SmartMy HRMS set up that way.