Accounts and sign-in
Companies, users, email codes, Microsoft Entra ID, Active Directory and verified domains.
Companies and users
Each customer is a company on dash.retivo.net. Users belong to one company, and the email address is the username. A company has at least one owner.
Ways to sign in
| Method | How it works | Second step |
|---|---|---|
| Retivo password | Password set by the user | A 6-digit code by email, every sign-in |
| Microsoft Entra ID | Single sign-on with your company's Entra ID tenant (OpenID Connect) | Whatever Entra ID requires, for example Microsoft Authenticator |
| Active Directory | The user's AD password, checked by your Retivo Node against your domain controllers over LDAP | A 6-digit code by email |
Each user has one method. Admins choose it when adding the user, or let the email domain decide.
Why Active Directory goes through the node
Your domain controllers do not need to be reachable from the internet. The password check runs on the node, inside your network, over LDAPS or LDAP with StartTLS. It needs at least one node to be online.
Verified domains
A company can claim its email domains (for example example.com) by adding a DNS TXT record. A verified domain:
- sends people with that domain straight to the right sign-in method,
- can create their Retivo user on first sign-in, with the role you choose,
- cannot be claimed by another company.
Public email domains such as gmail.com cannot be claimed.
Codes and sessions
- Email codes have 6 digits, work for 10 minutes and allow 5 tries.
- A session lasts 12 hours. Changing your password signs you out everywhere else.
- Repeated failed sign-ins are slowed down.
What's next
Last modified October 15, 2026