Signing in with Microsoft or Google

What this feature is for

Besides your email address and password, you can sign in to heyAtlas with your organization's Microsoft account or with your Google account. This article covers the Sign in with Microsoft and Sign in with Google buttons on the Sign in to the portal screen, linking your account on first sign-in, the consent screens you may meet at Microsoft and Google, the messages on the sign-in screen and recovering your account. You can read it without signing in.

• The buttons sit below the email and password form, after the "or" divider. Only the methods that are turned on in heyAtlas show a button; if a button is missing, that method is not available right now, so sign in with your email address and password.
• Signing in with Microsoft or Google does not change or remove your password. You can use either way whenever you like; signing in with your password always stays available.
• No new heyAtlas account is created this way. A Microsoft or Google account with the same email address can only be linked to an account you already have.

Which accounts you can sign in with

• The Microsoft or Google account must have the same email address as your heyAtlas account. If Microsoft or Google does not report the address as verified, the account cannot be linked.
• Your company may have turned off sign-in with Microsoft or Google, or opened it only to accounts from organisations and Google domains it has approved. This restriction only affects signing in with Microsoft and Google; you can keep signing in with your password.
• If your account type does not allow one of these methods, the sign-in screen shows a message saying so (see the table below).

Signing in with Microsoft or Google for the first time: linking your account

Your Microsoft or Google account is not linked to your heyAtlas account automatically on first sign-in; you confirm the link once with your password:

1. On the Sign in to the portal screen, press Sign in with Microsoft or Sign in with Google.
2. On the Microsoft or Google account picker, choose the account you want to use; sign in to it if asked. The account picker opens on every sign-in. The first time, Microsoft may also show a consent screen (see below).
3. You return to the heyAtlas sign-in screen. A banner such as "To link this Microsoft account (a***@company.com) to your heyAtlas account, sign in below with your email and password. The link is created once you have signed in." appears above the form; the email address is shown shortened.
4. Fill in Email and Password and press Sign in. If two-factor authentication is on for your account, also complete the Verification code step (or use Sign in with passkey); on this sign-in the code is asked even if your browser is recognised, and the link is created once the code step is passed.
5. When the sign-in completes, the link is created. No separate confirmation appears on screen; an information email with the subject "A new sign-in method was linked to your heyAtlas account" is sent to your email address. You can also see that the link was created on the Sign-in methods card of the Security screen: the method shows Linked. From then on, pressing Sign in with Microsoft or Sign in with Google is enough; your password is not asked, but the verification code still is if two-factor authentication is on.

Good to know:

• An account can have one link per method, and a Microsoft or Google account can be linked to only one heyAtlas account.
• The banner appears in the same way whether or not a heyAtlas account exists for that address. If you have no heyAtlas account, the sign-in does not complete and no link is created; contact the person who will create your account.
• The banner is valid for 10 minutes. The time starts when the banner appears, and the verification code step counts towards it. If you sign in through the form after the time is up, the sign-in still completes but no link is created, and no message tells you so; the banner may still be on the screen even though the time is up. Check on the Sign-in methods card of the Security screen whether the link was created; if the method shows Not linked, start signing in with Microsoft or Google again. If you do not want to link, press Don't link under the banner: the sign-in screen reopens without the banner and no link is created on that sign-in.
• If the link cannot be created, the sign-in still completes and the Security screen shows "Your Microsoft/Google sign-in link couldn't be created; you're signed in with your password. …". Usually this is because the Microsoft or Google account's address differs from your heyAtlas account's, that account is linked to another heyAtlas account, or you already have a link with this method. If your company's sign-in policy does not allow it, the same screen shows "Your company's sign-in policy doesn't allow this Microsoft/Google account. …".
• If you signed in with a temporary password (one passed on to you by the person who created your account), no link is created. The Set a new password screen shows "Your Microsoft/Google account was not linked because this session was opened with a temporary password. …". Save your new password, then sign in again with Sign in with Microsoft or Sign in with Google and confirm the link the same way.
• If you see "This Microsoft/Google account isn't linked to a heyAtlas account. …" instead of the banner, the account you chose cannot be linked on first sign-in (for example, the Microsoft account is a guest account in the organization, or the address did not arrive as verified). Sign in with your email address and password; once signed in, you can try linking it from the Security screen. Guest accounts and accounts with an unverified address cannot be linked there either.

Linking or removing a link after you sign in

Once signed in, open the Security screen from the user menu in the top-right corner. On the Sign-in methods card each method has a Link or Remove sign-in link button; both actions ask for your current password and, if your account has one, your verification code or passkey.

• A method that is not available for your account type shows "Not available for this account type".
• On an account without a password (one created through an invitation with Microsoft or Google), these buttons cannot be used; first set a password with Forgot your password? on the sign-in screen.
• In a session opened with a temporary password, links cannot be created or removed; change your password first.
• Once you remove a link, you can no longer sign in with that account and your sessions on other devices are signed out. The link is not restored automatically; to link it again, sign in with your password and use the Link button on the same card.

The Microsoft consent screen and administrator approval

• On your first Microsoft sign-in, Microsoft may show a consent screen asking you to grant the heyAtlas app permission. heyAtlas only asks to sign you in and to read basic profile details such as your name and email address; it does not ask for access to your mailbox, calendar or files. Accept the permission to continue.
• The consent screen may show "unverified" next to the app name. Microsoft shows this label for apps whose publisher has not gone through Microsoft's publisher verification; it does not stop sign-in from working.
• If your organization restricts users from granting apps permission on their own, Microsoft says that administrator approval is required. When you return to heyAtlas, the sign-in screen may show "Your organization's Microsoft administrator needs to approve the heyAtlas app. …". Below the message you find the text "Link for your IT administrator to grant consent" and an address; copy the address with the copy button next to it and pass it on to your organization's IT administrator.
• When a Microsoft administrator who is allowed to grant consent to apps opens that address and approves, they return to the heyAtlas sign-in screen with the message "Administrator approval was granted. Users in your organization can now sign in with Microsoft." On this return the sign-in screen always opens in Turkish, so the message is first shown in Turkish; to read it in your language, choose your language from the language menu (the globe icon at the top right of the page) and the message is shown again in that language. Then try again with Sign in with Microsoft.
• Until consent is granted, keep signing in with your email address and password.

Restrictions set by a Google Workspace administrator

If your organization uses Google Workspace, your administrator may have restricted third-party apps from accessing accounts. In that case Google may show a screen saying that access to heyAtlas is blocked, or you return to the heyAtlas sign-in screen with "We couldn't complete this with Microsoft/Google right now. …". Ask your Google Workspace administrator to allow the heyAtlas app; until then, sign in with your email address and password. Personal Gmail accounts do not have this restriction.

Two-factor verification, locks and sessions

• Signing in with Microsoft or Google only replaces the password step. If two-factor authentication is on for your account, the Verification code step opens after you return from Microsoft or Google; Sign in with passkey and Back to sign in are available in this step too. Verification you completed in your Microsoft or Google account does not replace this step.
• On a browser where you have passed verification before, the code may not be asked again for a while, just as when signing in with your password. On platform staff accounts the code is asked every time after signing in with Microsoft.
• If your account is temporarily locked because of failed password attempts, you can sign in with your linked Microsoft or Google account; this sign-in removes the lock. If a wrong verification code has also been entered since your last successful sign-in, signing in with Microsoft or Google does not remove the lock; the sign-in does not complete at the code step until the lock time is up.
• If your account has been deactivated, you cannot sign in with Microsoft or Google either; the message "Your account is inactive. Please contact your administrator." appears.
• The Your session has expired window that opens when your session ends also offers the buttons of the methods that are turned on. These buttons take you to Microsoft or Google and bring you back to the same page, but because the page reloads, changes you have not saved may be lost. If you do not want to lose your work on the page, sign in with your email address and password in the window.
• Signing out of heyAtlas does not sign you out of Microsoft or Google.

Invited accounts: continuing with Microsoft or Google

The link in the invitation email opens the Set a new password screen. In invitations for company and sales partner accounts, when sign-in with Microsoft or Google is turned on, the Continue with Microsoft and Continue with Google buttons also appear below the password form, after the "or" divider:

1. Press one of the buttons and choose your account on the Microsoft or Google screen.
2. If the chosen account's email address is the same as the address the invitation was sent to, the invitation is accepted, the link is created and you are signed in straight away.
3. Your account is set up without a password; the note under the buttons reminds you of this. If you want a password later, set one with Forgot your password? on the sign-in screen. This also removes your Microsoft or Google link; you can link it again afterwards from the Security screen.

• If the addresses do not match, the sign-in screen shows "The invitation couldn't be accepted with this Microsoft/Google account. …". Your invitation link stays valid: open the link in the email again and choose the right account, or set your password.
• If the invitation link has expired or has already been used, these buttons do not appear. If pressing a button shows the "Invitation link is invalid" notice, the link was used or expired in the meantime. In both cases, ask the person who created your account for a new invitation, or set your password with Forgot your password?.

When sign-in links are removed: recovering your account

If you suspect someone else has taken over your Microsoft or Google account, or you received an information email about a link you did not create:

1. Reset your password with Forgot your password? on the sign-in screen (steps: First sign-in, password and security).
2. The reset removes all your Microsoft and Google sign-in links and signs you out on every device.
3. Sign in with your new password; if you like, link your account again from the Security screen.

Other actions that remove links:

• Sign out everywhere: on an account with a password it also removes all sign-in links. On an account created through an invitation with Microsoft or Google that has no password, the link created by the invitation is kept; it is that account's only way to sign in.
• The person who manages your account giving you a temporary password or resetting your MFA. An MFA reset also keeps the invitation link of an account without a password.
• The person who manages your account removing the link. The link is not restored automatically: sign in with your password and confirm the link again. If your account has no password, first set one with Forgot your password?, or ask the person who manages your account to send your invitation again.

Changing your password under Change password on the Profile Settings screen does not remove links. Each time a link is created or removed, an information email is sent to your email address; if you did not do it, use the link in the email to reset your password straight away.

Messages you may see on the sign-in screen

Two of these messages, "The sign-in request has expired or was started in a different browser. …" and "Administrator approval was granted. …", always appear on a sign-in screen that opens in Turkish, because heyAtlas cannot tell your language at that point. To read them in your language, choose your language from the language menu (the globe icon at the top right of the page); the message stays on the screen and is shown in that language.