My account and Organization and SSO
Settings live in two places, depending on whom they affect:
| Where | What it holds | Whom it affects |
|---|---|---|
| Mi cuenta (My account; your avatar, at the bottom of the rail) | Your profile, your password, two-factor, the devices where you are signed in, your notifications and your substitute | Only you |
| Administración › Organización y SSO (Administration › Organization and SSO) | Name, single sign-on, Microsoft Entra ID groups, task deadlines, webhook signing, AI governance and security | The whole organization |
Changing organization settings requires the permission to update them (by default, Owner and Administrator). If you open Organización y SSO without it, you are taken to Mi cuenta.
My account
Section titled “My account”- Profile: Nombre and Apellido (first and last name). They show in the portal right away.
- Password: asks for the current one, the new one and its confirmation. The new one must be at least 8 characters long.
- Doble factor (app autenticadora) (Two-factor, authenticator app): when signing in, besides the password, you type a code from your phone. It works with Google Authenticator, Microsoft Authenticator, Authy and 1Password. When you turn it on you get backup codes: keep them; each one works only once. If your organization requires two-factor, it cannot be turned off.
- Suplencia (Substitute): who also gets your tasks while you are away, between two dates. See Substitutes.
Organization and SSO
Section titled “Organization and SSO”Organization
Section titled “Organization”Your organization’s visible name. The subdomain (your-company.cloud.zoansoftware.com) is read-only.
Single sign-on (SSO)
Section titled “Single sign-on (SSO)”Your team signs in with the company account —Microsoft Entra ID, Google Workspace or another OpenID Connect provider— with no extra password to remember, and whoever leaves the company loses access as soon as they are disabled in the directory. Depending on your plan, you can:
- Limit the Dominios de correo permitidos (allowed email domains).
- Crear usuarios automáticamente al primer acceso (create users automatically on first sign-in; without licenses, which an administrator assigns). With Microsoft Entra ID you can also create accounts by group, with roles by group: there the groups decide, and this option only applies to people outside them if you configure it so.
- Solo SSO (SSO only): disable the password for the allowed domains.
The screen shows the redirect URL you must register with the provider.
Test sign-in
Section titled “Test sign-in”Once SSO is configured, Probar inicio de sesión (Test sign-in) checks the connection with the provider without putting anyone’s access at risk: it works even while SSO is disabled, so you can test it before turning it on.
- Click Probar inicio de sesión. The provider opens in a new tab, where you pick the account you want to test with.
- When it returns, that tab confirms the test finished and you can close it. The result shows up in the SSO card.
The test checks the same things as a real sign-in: the issuer, the code exchange with the Client ID and secret, the token signature, that the token carries the email and that its domain is allowed. It also tells you, without changing anything, what would happen to that account: whether it already has an account, would be created on first sign-in or would need an invitation and, with Microsoft Entra ID, what the synced groups would do.
The test does not sign anyone in, creates no users or accounts, accepts no invitations and changes no roles. Only the person who started it sees the result, which lasts a few minutes; every test is recorded in the audit log. It requires the permission to update the organization.
If something fails, the result says what to check:
| Message | What to do |
|---|---|
| The client secret is invalid or expired (AADSTS7000215, AADSTS7000222) | In the app registration, under Certificates & secrets, create a new secret, copy its Value (not its ID) and save it with Editar (Edit). |
| The redirect URL is not registered (AADSTS50011) | Add exactly the redirect URL shown on the screen as a Web URI under Authentication. |
| The application does not exist in the directory (AADSTS700016) | Check that the Client ID and the directory ID belong to the same app registration. |
| Consent is missing (AADSTS65001) | A directory administrator grants consent under API permissions › Grant admin consent. |
| The domain is not among the allowed ones | Add the domain under Dominios de correo permitidos (allowed email domains) or test with an account from those domains. |
| The token carries no email | In Microsoft Entra ID add the optional email claim to the ID token (Token configuration); with other providers include the email scope. |
With some errors (for example AADSTS50011 or AADSTS700016) the provider shows the message in its own tab and does not return to Zoan Cloud; while you wait, the card reminds you what those codes mean.
Microsoft Entra ID groups
Section titled “Microsoft Entra ID groups”Brings in your directory’s groups with their members and owners, using your organization’s Entra application (or the SSO one). Here you connect the application, verify its permissions, choose which groups to sync and how often, and see the latest syncs. Step by step in Sync groups with Microsoft Entra ID.
Security
Section titled “Security”- Exigir doble factor a todos los miembros (Require two-factor for all members): each person enrolls at their next sign-in.
- Cierre de sesión por inactividad (minutos) (Idle logout, minutes): 5 to 480; empty uses the platform value (15 minutes). It applies right away to your session and to the others on their next reload. On shared computers, lower it (5–10 minutes) so a forgotten session closes quickly.
- The organization’s Zona horaria (Time zone): used in emails (task deadlines, escalations) and reports.
Task deadlines (SLA)
Section titled “Task deadlines (SLA)”Set, in hours, the deadline to handle tasks by origin: Aprobaciones de asistentes (assistant approvals), Tareas de procesos RPA (RPA process tasks), Tareas creadas por API (API-created tasks) and Tareas de flujos (flow tasks). The deadline flags the task as overdue, escalates it once and notifies, but doesn’t close it. See Tasks.
Webhook signing
Section titled “Webhook signing”The secret Zoan Cloud uses to sign the webhooks it sends to your systems, so they can check the notice is genuine. Mostrar secreto (Show secret) and Copiar (Copy).
AI governance
Section titled “AI governance”Turn on mandatory personal data masking for the whole organization and pick the types that are always masked: assistants and robots replace ID numbers, tax IDs, emails, phones, accounts, addresses and names with placeholders before sending text to the model. Ver registro (View log) takes you to AI governance.
Next steps
Section titled “Next steps”- Users and roles — who gets in, with which permissions and licenses.
- Governance — audit, usage and personal data.
- Zoan Cloud API — service accounts and API keys (Administración › Claves de API) to connect your ERP, CRM or BI tool.