Login Page Mode

ActiveManage offers two login page modes, controlling the order in which the user is asked for their credentials. The choice affects both user experience and the information surface attackers can probe.

Standard Mode

The traditional login form: email/username and password on the same page. The user types both and submits.

• Pros: Familiar; password managers autofill cleanly; one HTTP request per login attempt.
• Cons: Exposes whether an email exists when password fails (“account locked” vs “wrong password”). Cannot dynamically show different second-factor prompts based on the user.

Emailcheck Mode

The login is multi-step. Step 1 asks only for the email. The next screen shows the password field — and the available authentication methods customised to that specific user (e.g. “Sign in with Microsoft” for SSO-enabled users, “Use passkey” for users who've enrolled one).

• Pros: Hides which auth methods are configured per user from random visitors; works elegantly with SSO redirection (Microsoft users skip the password step entirely).
• Cons: More steps; some password managers struggle to autofill cleanly.

Worked Examples

• Internal-only app: Standard mode is fine — users are known and the threat model doesn't care about email enumeration.
• Public SaaS: Emailcheck — different customers use different IdPs, so the second step routes each to their provider.
• Mixed B2B/B2C: Emailcheck — staff get SSO automatically while customers see a password field.
• White-label tenant: Emailcheck — the tenant's brand appears only after the email is recognised, keeping the public login page neutral.

This article gives a decision framework for selecting standard vs emailcheck login mode based on your audience, security posture and SSO usage.

Decision Factors

• Do you use external IdPs (SSO)? If yes, emailcheck is strongly preferred — it lets the platform route users to their identity provider automatically.
• Are usernames public-facing? If anyone can guess valid emails (e.g. employee names), emailcheck reduces enumeration risk.
• Does your audience use password managers? Mostly fine with both; some legacy managers handle standard better.
• Do you have a single auth method? If everyone uses local username/password, standard is simpler.

Common Configurations

• SaaS with corporate SSO: Emailcheck. The platform detects whether the email's domain has an SSO config and redirects accordingly.
• Healthcare clinic: Emailcheck. Patients see a password field, clinicians get redirected to Microsoft.
• Small business app: Standard. Everyone has a single password-based account; simplicity wins.
• Public consumer site: Standard. Friction matters most; emailcheck adds a step.

Switching Modes

You can change the mode at any time without re-issuing credentials. Existing users notice the new flow on their next sign-in. Provide a brief banner explaining the change.

Tip: Test the chosen mode with a few users before global rollout. Edge cases (password managers, screen readers, single-page-app deep links to the login page) often surface only in real usage.