Pitch N Hire SSO & RBAC Integration
Yes. Pitch N Hire supports single sign-on with Google or Microsoft work accounts, restricted to your verified company domain, plus an optional Require SSO switch that turns off password sign-in entirely. Role-based access is separate: User Roles under Workspace settings controls what each teammate can see and do.
Two different questions get asked together and are worth separating. Single sign-on decides how people get in. Roles and permissions decide what they can touch once inside. Both live in Settings, in different panels.
Which single sign-on providers does Pitch N Hire support?
Google and Microsoft work accounts. You enable them individually with the Allow Google sign-in and Allow Microsoft sign-in switches on the Single Sign-On panel, and once at least one is on, your team sees Continue with Google and Continue with Microsoft buttons on the sign-in screen.
What does the mapped domain do?
It scopes SSO to your company. The mapped domain is the verified company domain SSO is locked to, and only work emails on that domain can sign in this way — so enabling Google sign-in does not let anyone with any Google account through. If the panel shows the mapped domain as Not set, you need to set your company domain in company settings first, because domain-restricted SSO has nothing to restrict to until then.
What happens when you turn on Require SSO?
Email and password sign-in is disabled for the entire company and everyone must use Google or Microsoft. You have to enable at least one provider before the switch is available. This is the one setting on the panel with a genuine blast radius, so confirm every person on your team has a working Google or Microsoft account on the mapped domain before you turn it on — once required, password sign-in is off for everyone at once.
How is role-based access different from SSO?
SSO governs authentication, roles govern authorisation — how you get in versus what you can do. Roles are managed separately, under Settings → User Roles in the Workspace group, which opens a screen with Users, Roles and Permissions, and Panelists tabs. A correctly configured SSO setup with no role discipline still lets everyone see everything.
What should you check before requiring SSO?
Three things. That the mapped domain is set and correct. That at least one provider is enabled and has been tested with a real sign-in. And that everyone who needs access — including anyone infrequent, like a hiring manager who logs in twice a quarter — actually has an account on that domain. The panel's Save changes button stays disabled until something changes, so you can review the state safely before committing.
How to set it up
- Open Settings → Single Sign-On under Workspace (app.pitchnhire.com/account?submenu=sso).
- Check the Mapped domain. If it shows Not set, set your company domain in company settings first so SSO can be domain-restricted.
- Turn on Allow Google sign-in, Allow Microsoft sign-in, or both, then click Save changes.
- Optionally turn on Require SSO — but only after confirming everyone has a working account on the mapped domain, because it switches password sign-in off for the whole company.
SSO & User Roles integration — FAQs
Which identity providers can my team sign in with?
Can anyone with a Google account sign in?
What does Require SSO actually change?
Is SSO the same as roles and permissions?
The mapped domain says Not set — what now?
The applicant tracking system for recruiters and hiring teams
Pitch N Hire is an applicant tracking system. Post roles, screen applicants, run structured interviews, and make offers from a single pipeline — free for 1 user.
Free for 1 user · No credit card · Talk to a real hiring expert
Connect SSO & User Roles with Pitch N Hire
See how Pitch N Hire fits your hiring stack on your real roles. Start free with the 1-user plan, or book a demo.
Prefer to talk? Book a demo Talk to sales View pricing
Free 1-user plan · No credit card · Talk to a real hiring expert
