Sign-in email and email

An identity has one email: the Primary email attribute, the directory and contact address. Your HR system or directory writes it, or an administrator sets it, and Owlie sends approvals, tickets, reviews and other work notifications there. Several identities can share one, such as a team mailbox.

The sign-in email is not a second profile email. It is the identity's email sign-in credential: the address the person types to sign in. It is also the only address that receives security mail, such as sign-in links, password resets and security notices. Only one identity in your organization can hold a given sign-in email, and Owlie uses it only after the person proves they can read it, or after your directory vouches for it (see Keep the sign-in email in step with the email).

The two often hold the same address. By default, when a connected system changes someone's email, their sign-in email moves with it. When it can't, or when you turn that off, Owlie proposes the new address to an administrator instead. Notifications explains which mail goes to which address.

Where to find it

Open the identity from Admin > Directory > Identities and select the Attributes tab. The Sign-in block near the top shows:

Field	What it shows
Sign-in email	The address, or Not set. Follows the identity's email appears beside it when the setting is on and the sign-in email can follow: it is verified with no change waiting, and the person is active and can sign in.
Status	Pending (set but not verified yet), Active (verified), or Held (the identity is terminated).
Verified	When the address was verified.
Sign-in access	Allowed, Blocked, or Not granted (the person hasn't been given sign-in access yet). Blocked since appears when an administrator blocked sign-in. Service accounts don't sign in, so they show the state without a switch.

Below it, the block lists any Proposed sign-in emails and the identity's SSO links. People see their own sign-in email under My settings > Security > Password.

Setting, changing or releasing someone else's sign-in email, blocking or allowing their sign-in, and removing their SSO links need the identity.login.manage permission, which the Owner and Admin roles include. Owlie also asks for a recent sign-in first. You can only manage the sign-in of someone whose permissions you also hold, so an administrator with a narrower role can't take over an owner's sign-in.

How someone gets a sign-in email

A new sign-in email starts as Pending. A pending address can receive only the link that verifies it: it can't receive sign-in links or password resets, and nobody can sign in with it by typing it. It becomes Active when someone opens that link.

• Invitation. When you invite an administrator, Owlie gives them a pending sign-in email and sends an invitation link to it. The address stays pending until they open the link.
• Set by an administrator. In the Sign-in block, select Set sign-in email, enter the address and select Set sign-in email. Owlie sends a verification link to it. Setting a sign-in email also allows sign-in, unless an administrator has blocked it.
• First SSO sign-in. When someone signs in through an SSO provider for the first time and the provider verified their address, Owlie links the provider account to their identity and records that address as a verified sign-in email. An invitee who signs in through SSO this way verifies their pending address too. Sign-in and SSO explains which identity a first SSO sign-in can claim.
• Account claim. When a person completes an account claim, their work email from a connected directory becomes their sign-in email, already verified, and sign-in is allowed.
• Signup. The person who creates an organization gets a pending sign-in email and a welcome link. Until some owner has verified their sign-in email, requesting a magic link for that address sends the welcome link again.

A person without a sign-in email can set their own under My settings > Security > Password.

Change a sign-in email

To change someone's sign-in email, select Change in the Sign-in block, enter the new address and select Change sign-in email. A person can change their own from My settings > Security > Password by selecting Change. Owlie may ask them to sign in again first.

The change takes effect immediately:

1. The new address becomes the pending sign-in email, and Owlie sends a verification link to it.
2. The old address stops working. If it was verified, Owlie sends it a notice that the sign-in email changed. A terminated person's old address gets no notice, because that mailbox may already belong to someone else.
3. An administrator's change signs the person out everywhere. When people change their own address, the session they used stays signed in and every other session is signed out.

Until someone opens the verification link, the person can't sign in with a password or magic link at either address. A linked SSO account keeps working, and the person's password keeps working once the new address is verified. While the address is pending, Resend verification sends a new link.

Owlie refuses the change in two cases:

• The address is another identity's sign-in email. The message names who holds it. Change or release it on that identity first. If the holder is a former employee, follow Reusing a sign-in email. If both identities are the same person, move the accounts instead.
• The address is the email or secondary email of another identity that isn't terminated. Giving someone a shared address as their sign-in email would let everyone who reads that mailbox sign in as them. If you are sure the address belongs to this person, enter a Reason for override and select Set anyway. Owlie records the reason on the identity's audit trail. People changing their own sign-in email can't override this.

Block or allow sign-in

Turn off Sign-in access and confirm with Block sign-in to stop someone signing in. Owlie signs them out everywhere immediately, and they stay out until you turn it back on. A block also stops a first SSO sign-in from linking to them, and it survives releasing their sign-in email.

You can also block someone who hasn't signed in yet. When Sign-in access shows Not granted, select Block sign-in beside it, and neither a first SSO sign-in nor an invitation can give them access until you turn it on. The switch and button aren't offered for service accounts. Blocking sign-in doesn't change the identity's lifecycle state or Owlie Status; see Lifecycle state and overrides.

Turning Sign-in access back on is refused while the person's sign-in email is now the email or secondary email of another identity that isn't terminated. Mail systems sometimes reissue a leaver's mailbox, and allowing sign-in would let the new owner of that mailbox in as them. Change or release the sign-in email first.

Release a sign-in email

Select Release and confirm to remove someone's sign-in email. Outstanding sign-in links stop working, and the person can't sign in with a password or magic link until a new sign-in email is set. A linked SSO account keeps working. Releasing a verified address also signs the person out everywhere and sends the address a notice. A terminated person's address gets no notice.

A released address can become another identity's sign-in email. A terminated identity keeps its sign-in email until you release it; see Reusing a sign-in email. Removing an identity releases its sign-in email too; see Removing an identity.

Keep the sign-in email in step with the email

The login setting Keep sign-in email synced with the identity's email is on by default. Find it under Admin > Tenant Settings > Authentication > Login methods, next to Magic Link and Owlie credentials. It shows even when both of those are off. Changing it needs the tenant.login_methods.modify permission and a recent sign-in, like any login method change.

With the setting on, when a connected system such as a connector or a sync changes a person's email, and that value is the one that wins under your attribute resolution order, Owlie moves the person's sign-in email to the new address and keeps it verified, because your organization's directory stands behind it. This happens only when all of these are true:

• The person's sign-in email is active: verified, with no change waiting for its verification link.
• The person can sign in now: active, not blocked, and not a leaver or terminated.
• The new address is valid.
• The new address isn't another person's email or secondary email.
• Nobody else signs in with the new address.

When the sign-in email moves:

• People who are signed in stay signed in.
• Unused sign-in links and password-reset links for the old address stop working.
• The old address gets an email saying that the organization's directory changed the sign-in email for the person's account in your organization, and when.
• SSO sign-in is unaffected. Owlie recognizes a linked provider account by the provider's ID, not by the address.

Turning the setting on also aligns people whose sign-in email lags the email a connector provides, under the same conditions.

When any condition fails, nothing moves. The change becomes a proposal for a person who can sign in: for example when an administrator edited the email by hand, a derived (computed) value won, the person hasn't accepted their invitation or has a change waiting for its verification link, or the address clashes with someone else's. A leaver, or someone whose sign-in is blocked or whose account is disabled, gets no proposal: their sign-in email changes only when an administrator changes it. With the setting off, every directory change for a person who can sign in is a proposal that an administrator accepts.

Whose email wins

The sign-in email follows the identity's email only when a connector's value wins. People created by invitation, signup or SSO just-in-time have their email recorded as a manual value. Under the default resolution order, manual values win over connectors, so a later HR value doesn't become their email and their sign-in email doesn't follow it. To make it follow, rank the connector above manual values, either in the attribute's resolution policy or in the directory default.

Who this affects

Anyone who can configure an integration or connector, or change the email resolution order, can in effect change sign-in addresses. That is owners and admins, who can manage sign-in emails anyway. If your organization wants an administrator to review every change, turn the setting off.

Sign-in email proposals

Owlie proposes a new sign-in email when either of these reports an address that differs from the person's sign-in email:

• their linked SSO provider starts sending a different address that the provider verified; or
• their email (Primary email) changes and the sign-in email can't follow, for example because the setting is off or an administrator made the edit.

Leavers, and people whose sign-in is blocked or whose account is disabled, get no proposals.

Owlie never applies a proposal on its own. It raises a low-severity alert, New sign-in email proposed for the person, under Alerts at the top of the admin sidebar. The alert opens the person's Sign-in block, where Proposed sign-in emails lists the address and its source, such as "From Okta" or "From the directory email". An address that is at neither the current sign-in email's domain nor a domain your SSO login methods allow carries a Different domain badge. Check that the mailbox belongs to the person before you use it.

For each proposal you can:

• Use as sign-in email (needs identity.login.manage). This opens the change dialog with the address filled in and starts the change at once, exactly as described in Change a sign-in email: the old address stops working and the person is signed out. The proposal shows "Change started: opening the link sent to this address completes it" until someone opens the verification link, then closes on its own. A provider reporting the address as verified doesn't skip that link.
• Dismiss (needs alert.resolve). The sign-in email doesn't change, and Owlie won't propose that address for that person again. Resolving the alert from Alerts does the same.

Owlie proposes nothing for someone who has no sign-in email (use Set sign-in email instead), who isn't active, whose sign-in is blocked or who is terminated. Blocking sign-in, terminating or removing someone closes their open proposals. A proposal stays open if the source later stops sending the address, so dismiss a stale one.

A sync raises one proposal per person whose email changed. A change that renames many people at once, such as a move to a new email domain, produces one alert for each of them.