Choosing an organization at sign-in

The page is titled Choose an organization and says: "Your account belongs to more than one. Pick the one to continue with." Each organization you can use is a row with its name and an arrow button, which a screen reader announces as Continue with followed by the name. Select the arrow on the organization you want and the sign-in carries on.

Many organizations#

Once you belong to eight or more organizations, a Filter organizations field appears above the list. Type part of a name to narrow the rows. Underneath, a status line reads 1 organization or N organizations, or No organization matches. when nothing fits. Clear filter empties the field. With fewer than eight, the list is short enough to show without a filter.

Only organizations where your membership is Active are offered, and only those the application is allowed to work in: the organization that owns the application, or one that has installed it (applications TDACorp ships itself may enter any of yours). A Suspended or Removed membership does not appear here, and neither does an organization that has not installed the application. See Memberships.

You do not see this screen on every sign-in. It appears only when both of these hold:

• the application you are signing in to works inside one organization at a time;
• your account has more than one active membership.

With a single active membership there is nothing to choose, and the sign-in goes straight on.

If the application works inside one organization at a time and you have no organization it can enter, the sign-in instead stops on Create your workspace: "This app needs a workspace to sign you in, and you do not have one yet. Create your own: it starts with you as its only member." Nothing is created until you select Create my workspace. An account that an organization manages does not get this step.

The sign-in, and the session it creates, is made for the organization you chose. That affects what comes next.

• What an application can do for you. An application you sign in to is limited to what your role in that organization allows. If it asks for the tdaid.tenant scope, it is told which organization you are signed in to. See Connected apps.
• Which organization a new access token can act in. When your session belongs to an organization, the form for a new access token offers only that organization. A session that is not tied to an organization offers all your active ones.
• Sign-in requirements. An organization can have its own requirements for how people sign in to it, such as a second factor or single sign-on. These are checked after you choose, so a sign-in that was fine for one organization may need more for another. Where an organization requires single sign-on (behind the sso_enforcement and tenant_connections feature flags, both default OFF), a sign-in that did not go through its identity provider is refused, and the email step can instead show Sign in with your organization with Continue with the organization's name and Use another method.

Inside your account you can change organization without signing in from the start. The organization switcher is at the top of the account navigation (on a phone, at the start of the strip across the top). Its trigger names the organization your account pages are in. The list is headed Organizations, can be searched with Search organizations, and shows your role in each as Owner, Member or Guest. Your personal workspace is listed too. Only Active memberships are offered. With exactly one, the switcher is a plain label with no menu, because there is nothing to change to.

The switcher never shows an empty trigger. It names, in this order: the organization your session is in; else the one you used last on this browser; else your personal workspace; else your first active organization. Your session itself is in an organization only after a switch (or the automatic step below) puts it there. Until then the name is what the page shows, not a fact about the session, and the pages that read the session's own organization (Security and the form for a new access token) use the session's, not the one named.

Choose an organization and your browser gets a new account session in it. The organization has the same say it has at sign-in: your membership must be active, its single sign-on and assurance rules apply, and it can ask for a second factor, which you give on the ordinary sign-in page. If you may not enter the organization, the switch is refused with one answer, whatever the reason. If it requires single sign-on and you have not signed in through it recently enough, the switch is refused and you sign in through your organization instead. Switching is limited to a handful of times in a short window.

Remembered on this browser#

After a switch succeeds, the browser remembers the organization in an HttpOnly cookie named __Host-tdaid_org. It holds only the organization's identifier. It is a hint: the page checks it against your active memberships every time, it grants nothing, and an organization you may no longer enter is simply not selected. It lasts a year by default, a limit the operator can change between 1 and 400 days, and the account Sign out button clears it. See Cookies.

When your account session is in no organization and one is remembered, the page tries once in each browser tab to enter it for you, through the same switch described above. It does this only when no extra step is needed. If a second factor or anything else is needed, or the attempt fails, nothing happens on its own: the button Continue in followed by the organization's name stays under the switcher, and selecting it runs the ordinary switch.

The switcher says what it does: "This changes the organization for your account pages only. Apps you are signed in to keep their own organization." Two account pages depend on the organization: Security, which reads the organization's sign-in rules, and the form for a new access token, which offers only the organization your session belongs to.

A switch never makes your session newer than the one you switched from, and it does not carry a recent confirmation (step-up) with it, so an action that needs one asks again. The session you left ends, unless an application you are signed in to still depends on it, in which case it stays open. See Sessions.

To work in a different organization inside an application, sign in to the application again and choose the other one. Your other sessions keep their own organization, and you can see them under Sessions.