CARDESS SSO
One secure login for every CARDESS app. Passwordless if you want it.
Universal sign-in for your teams, partners and customers. Use your Microsoft identity, passkeys or standard OpenID Connect.
Why SSO
One login, every app.
Sign in once and move between M:FLEET, ECOM, Settings and partner tools. Deep links survive the login.
Passwordless.
Passkeys with fingerprint or face, or a one-time SMS code. Nothing to phish.
Bring your own identity.
Your employees sign in with Microsoft Entra ID. Each lands in the right location.
An identity provider for your tools.
Standard OpenID Connect lets helpdesk, file-sharing and partner systems use CARDESS accounts. Groups are provisioned automatically.
You stay in control.
Consent screens and clients limited to chosen locations. A session length policy. A device list with remote sign-out.
Watched every day.
Lockout after repeated failures and full login logs. An automated sign-in health check runs daily.
Everything SSO does
The full feature list, grouped by what you want to get done.
Signing in
- One universal sign-in page for all apps. It returns you to where you started. It takes on the app's light or dark look and branding. It works on phones and in pop-ups.
- Multi-location users choose a location at sign-in. Single-location users go straight in.
- Server-side sign-out with a clear signed-out screen.
Passwordless and strong authentication
- Passkeys (WebAuthn) in the FLEET App, offered once per device.
- Phone sign-in with a one-time SMS code. Phone verification in the profile.
- Username and password with lockout and remaining-attempts hint.
- Configurable session length (up to 7 days) and idle timeout.
Your identity provider and standards
- Microsoft Entra ID (Azure AD) sign-in per location.
- OpenID Connect provider: authorization code with PKCE, discovery, refresh and revocation.
- Consent screen. Client registration limited to chosen locations.
- Machine-to-machine credentials for integrations.
Self-service, helpdesk and monitoring
- Self-service password reset. Invite and reset links land on the set-password screen.
- Zendesk agents are signed in automatically from their Zendesk session. Zendesk itself signs in via CARDESS.
- Login logs and a daily automated sign-in health check with e-mailed report.
Questions about SSO
- Can our employees sign in with their Microsoft account?
- Yes. Microsoft Entra ID (Azure AD) sign-in is available per location. Users sign in with their company account. They land in the right location.
- Do you support passwordless sign-in?
- Yes. In the FLEET App, users can sign in with a passkey: fingerprint or face. A one-time SMS code to a verified mobile number also works.
- Can other tools use CARDESS accounts to sign in?
- Yes. CARDESS is a standard OpenID Connect provider. Zendesk and file-sharing tools already sign users in with CARDESS accounts. Groups are provisioned automatically.
- How are integrations authenticated?
- Integrations use OAuth 2.0 machine-to-machine credentials. Each client can be limited to chosen locations. Its secret can be rotated or disabled in Settings.
- How is sign-in monitored?
- Every successful and failed login is logged. Accounts lock after repeated failures. An automated check verifies sign-in every day and e-mails a report.