ActiveManage supports a stack of authentication methods, each suitable for different audiences and security postures. Most deployments mix several — staff sign in with corporate SSO while customers use email-and-password.
Supported Methods
- Local username/password — the built-in method; credentials hashed with Argon2id and stored in the platform's database.
- Microsoft 365 / Azure AD (OAuth2 / OpenID Connect) — sign in with a corporate Microsoft identity.
- Google Workspace — OAuth2 sign-in for organisations on Google Workspace.
- SAML 2.0 — enterprise SSO compatible with Okta, Auth0, OneLogin, ADFS and others.
- Magic link — one-time tokens delivered by email; useful for low-friction customer flows.
- Passkey / WebAuthn — passwordless cryptographic authentication using device biometrics or hardware keys.
- API token — for programmatic access by integrations and headless clients.
Choosing the Right Methods
- Internal staff: SSO (Azure AD / Google / SAML) — minimises password sprawl and inherits the corporate identity lifecycle.
- External customers: Local password plus optional magic-link for password-shy users.
- High-security roles: Local password + mandatory 2FA, or passkey.
- API integrations: Long-lived tokens (rotated) or short-lived JWTs.
Stacking Methods
A single user can have multiple enabled methods. For example a staff member could use Azure AD for daily sign-in and a passkey as a backup for when SSO is down. The login page shows whichever options the user (or their tenant) has enrolled.
Note: When SSO is enabled, you can disable local password sign-in for that user to prevent it being used as a back door. Look for the per-user toggle on the user profile.