Single sign-on and linked identities
An external identity is what tells Chetty that a person on a chat platform or a sign-in service is a particular account.
How an identity binds
An identity is bound by provider, tenant and subject, and it can belong to only one Chetty account. An account cannot hold two subjects for the same provider and tenant.
E-mail is only a controlled linking aid. The external subject identifies the account, so a unique e-mail match can link someone, while an ambiguous match is refused and an existing subject binding always takes precedence.
Turn on Microsoft SSO
Microsoft SSO works only when the Microsoft plugin is enabled and its SSO switch is on. Sign-in is limited to the configured tenant.
- Enable the Microsoft plugin.
- Turn on its SSO switch.
- Confirm the tenant, and the project settings the plugin offers for new accounts.
A chatbot account cannot be linked to an external identity at all.
Create accounts from the directory
Automatic account creation is off unless ssoProvision is explicitly set to tenant.
Provisioned accounts start as passwordless non-administrators, created the same way as an account in Users. Their project comes from the plugin's ssoNewPersonalProject and ssoDefaultProjects settings, and their grants and preset project memberships come from Preset for new accounts under Users → Options → Default settings for users.
With no preset selected their grants start closed. Behaviour is inherited from the preset and the instance defaults rather than copied into personal settings.
Provisioning also asks Microsoft Graph to confirm an enabled member account. Guests, disabled accounts and non-members are refused, and so is an unavailable directory check.
Admin: SSO cannot create the installation's first administrator. Create that account through first-run setup.
Direct platform chats
A direct 1:1 platform chat is personal only when the sender has a verified external identity linked to a Chetty account. Groups and channels are shared conversations, even when the sender is an administrator in that platform.
In a shared conversation, Chetty uses the verified sender's account-scoped state for that turn; it does not inherit the account that opened the room.
A direct chat created before its sender was linked may initially belong to the instance operator. Once the sender is verified, Chetty can adopt the chat without moving its transcript, usage or files.
After upgrading from SSO defaults
The Microsoft SSO provisioning settings for default models, default plugins, allowed tools, the preferred model and YOLO moved to the instance defaults on upgrade. Each value fills only an empty slot, so a value you already configured stays.
If Teams previously had ssoDefaultYolo enabled and no shared permissions default was stored, YOLO became the default for every human account without its own rules, including existing accounts and accounts created outside Microsoft SSO.
Review the legacy setting before upgrading, and the shared Rules and YOLO section afterwards. Accounts with their own permission settings keep them.