Client portal: access, SSO and sharing
Signing in
Clients sign in with a password, a single-use magic link, or SSO if you've set it up. A magic link works once — if two people (or an email scanner and the user) open it at the same moment, only one gets a session. Sign out ends the session on the server, not just in the browser. Tokens are stored hashed. A person can have at most three unused sign-in links (or three unused password-reset links) at a time; further requests send nothing until one is used or expires.
Someone whose account was created by SSO signs in with SSO only: magic links, password reset and password sign-in aren't offered to them, so access always goes through the client's identity provider, its MFA and its sign-in policies.
SSO: who gets in
With Google or Microsoft SSO configured for a client, Graften only creates an account for someone whose email domain is in that client's allowed domains list (Allowed email domains in the SSO settings). Anyone else must already have an account (be invited). This matters because a Google OAuth app set to "External" will sign in any Google account; the allowed-domains list is what keeps that to the client's own staff. Existing, active users sign in as before.
The identity provider must confirm the email address (the email_verified claim). Microsoft Entra doesn't send that claim, so for Entra Graften uses the user's sign-in name (preferred_username) and never signs in a guest account as a member. An SSO sign-in has to finish in the browser that started it.
After someone's first SSO sign-in, their portal account is tied to their account at the identity provider, not just their email address: if another identity later presents the same email, it is refused, and a person whose address changes keeps their access.
Removing a client's staff member
In the Client Portal tool, pick the client: Portal Users lists a client's portal users with how they sign in (invite pending, SSO or password) and when they last signed in. Only an account admin can send portal invites, deactivate or reactivate a user, or revoke a link. Deactivate ends their sessions immediately, cancels their sign-in, invite and reset links, and revokes share links sent to their address for that client. Reactivate restores access. A deactivated user can't get back in through an old invite, a password reset or SSO.
What the dashboard shows
Findings are never shown as "none" for a client Graften hasn't measured: the dashboard says whether findings are available, not yet assessed, unavailable or hidden by you. Findings come from the latest security audit of each of the client's connections; a Copilot readiness scan is not a security audit and doesn't replace them.
Risk titles follow the same show findings setting. With findings hidden, the dashboard shows only how many risks are open and resolved, not what they are.
Dark-web monitoring shows green only when every monitored domain has been scanned and nothing was found. A client with no monitored domains is shown as not monitored, and a domain added but not yet scanned is shown as not yet scanned — never as clean. If a scan fails for a domain, the domain keeps its previous scan date and is not marked clean.
Shared links
- Portal links you send show as the client's Active portal link and last at most 90 days. A client user's own SSO sign-in is not a share link: it is never shown or offered as one.
- Report links and evidence package links are stored hashed and stop working if the client is deleted, or if your Graften account is suspended or deleted (see below). Evidence links last 1 to 365 days (the portal uses 30).
- Branding: colours must be hex values and logos HTTPS URLs; saving one setting doesn't clear the others.
If your Graften account is suspended or deleted
Your clients lose access at the same moment you do. Portal sign-in (password, magic link and SSO), existing portal sessions, the portal dashboard, evidence package links, proposal links, and change and service desk approval links all stop working; clients see a message that the service is unavailable (HTTP 403 SERVICE_UNAVAILABLE). An approval or proposal decision refused this way doesn't use up the link, so if the account is reactivated, links that haven't expired work again.