Sign In With Your Company

Single sign-on is part of the Pro plan and up (Pro and Restaurant), with no separate price. It isn’t on the Free or Walk-in plans.

Ask us to turn it on for your business through the contact form. Once it’s on, the business’s owner finds Single Sign-On on Owners & Managers and sets it up.

It is standards-based: OpenID Connect and SAML 2.0. We send setup steps for Microsoft Entra ID, Okta, Google Workspace and Cisco Duo when you ask, written from each vendor’s documentation. Another system that speaks either standard asks for the same kinds of values.

Not to sign in through your company. Until you turn on Required mode, people who already have a NextUp account can still use their usual way in. With Required mode on, the people on your team whose address is on your proved domains must use company sign-in, and the business’s owner stays exempt as a safety net. Turning Required on signs those people out once. It holds your own team only: someone who is not on it, such as a customer of another business who used a work address, keeps an ordinary sign-in.

With user sync on, turning them off in your identity system takes them off the team and signs them out of NextUp everywhere, including any other business they use, once your provider sends the change. Their NextUp account and its records are kept. Without user sync, turning them off at your provider stops them signing in through your company login, and an owner removes them from the team on NextUp.

No. Your domain only works after a DNS record that only your IT team can add proves it is yours. A domain can belong to one business, public mail domains such as gmail.com can’t be used, and nobody can prove a domain they don’t control.

The business’s owner is exempt from Required mode, so the owner can still sign in the usual way and switch the connection off. Nothing is deleted when you do. If the plan drops below Pro, or we turn single sign-on off for the business, Required stops applying and people sign in the usual ways.

A company sign-in counts as the second step, the way a passkey does. By default NextUp does not check that your provider asked for one, so require multi-factor sign-in in your provider’s policy. The owner can also turn on a check that refuses any sign-in the provider does not report as multi-factor. NextUp reads what the provider’s signed answer says and accepts the provider’s own labels for a second method (a one-time code, a security key or a fingerprint, for example), so it cannot tell how strong the method was or see how anyone actually signed in. This replaces an owner’s “everyone must use two-step sign-in” setting for people who sign in through the company. A person who has any role in another business is asked for their authenticator code if they have one, and otherwise confirms by an emailed link each time. People who sign in the usual ways keep NextUp’s own two-step sign-in.

Yes, at sign-in. The owner lists the groups that mean manager and the groups that mean staff, and each company sign-in sets the person’s role from them: manager if they are in a manager group, otherwise staff if they are in a staff group, otherwise the default role the owner chose. The owner can also name a custom role (a named set of the manager permissions, such as refunds or team pay) and list the groups that give it: those people become managers with that role, and if they are in the groups of several roles the first role in the owner’s list wins. Move someone to another group and their role follows the next time they sign in, or when your provider pushes the change. An owner’s role is never changed, nobody is removed this way and nobody becomes an owner. Groups your identity system pushes through user sync count too.

Yes. Point a tile or bookmark in your launcher at the sign-in link on the settings screen. It starts a normal sign-in, and the person lands in NextUp signed in. For SAML, the owner can also turn on a switch (off unless turned on) that lets your provider’s own tile start the sign-in; it then only signs in people who already belong to the business, and the answer must be signed, fresh and used once. If the browser already has a NextUp session open, the person is asked “Continue as …?” and must click Continue before it is replaced. With the switch off, such an answer is ignored and nothing is recorded.

No. We don’t claim SOC 2, ISO 27001 or any other certification. The Security page lists what we do, and what we don’t.

No. A location’s staff PIN for its shared floor screen is separate. Company sign-in is for people’s own sign-ins.