# Microsoft sign-in

Source: https://arccare.co.uk/help/company-setup/microsoft-sign-in
Last updated: 2026-11-09

If your company uses Microsoft 365, your people can sign in to ARC with their work account instead of an email code. You can also make it compulsory.

Microsoft sign-in only signs people in. It does not create accounts. Everyone still needs to be invited to ARC first.

## Set it up

1. **Ask your Microsoft admin to connect it.** Someone who manages your Microsoft 365 (Entra) has to agree to it. On the **Microsoft sign-in** card, select **Connect Microsoft**. They sign in and approve. ARC asks only to know who is signing in. It cannot read emails or files.
2. **Add your email domains.** For example `yourcompany.co.uk`. Public domains such as gmail.com cannot be used.
3. **Wait for ARC to approve each domain.** We check that the domain is yours. Nothing changes for your people until we do.
4. **Choose Allowed or Required** (below).

## Allowed or Required

|  | **Allowed** | **Required** |
|---|---|---|
| People on your approved domains | Can use Microsoft **or** an email code | Must use Microsoft |
| Email codes | Work as normal | Not sent to those people |
| Everyone else | Email code | Email code |

Start with **Allowed**. Once people have signed in with Microsoft, you can move to **Required**.

"Everyone else" means anyone whose ARC email is not on an approved domain, for example a contractor using their own address. They keep the email code.

## Exempt admins

Before you can choose **Required**, pick **one or two company admins** to be exempt. They keep the email code as a way in if Microsoft has a problem or your Microsoft admin is locked out. Choose people you trust. Each time one of them signs in with a code, ARC records it in the audit log.

## People who can't use Microsoft

The card lists **Cannot sign in with Microsoft**. These are people whose ARC email is not on an approved domain. They are not locked out. They keep the email code. To move them over, change their email in ARC to their work address.

The same people show on **Company Admin**, **Users** in a **Signs in with**column. It only appears while Microsoft sign-in is on. It shows:

- **Microsoft**: they have signed in with Microsoft before.
- **Email code**: they use the code. Under Allowed this is anyone who has not tried Microsoft yet. Exempt admins always show this.
- **Microsoft (not yet linked)**: your company requires Microsoft and they have not used it yet. They will be linked the first time they sign in.
- **Email code only**: their email is not on an approved domain, so Microsoft is not available to them.

## When someone leaves

Switch the person off in Microsoft as you normally do. ARC checks Microsoft again at least every **12 hours**, so they lose access within 12 hours. If you need it to be immediate, ask ARC to disable their ARC account.

## If your company is removed

If ARC wipes your company, the Microsoft set-up goes with it: the connection, domains and every link between people and Microsoft accounts.

---