Workspaces on Range’s Premium and Enterprise plans have the option to customize their login and authentication settings to suit their specific needs. These settings control how users at your organization are allowed to sign up for Range, who can be invited, and what authentication methods can be used.

Your account manager or a support representative can make any changes for you.

Supported authentication providers

Range supports the following authentication methods:

• Google — Google Workspace (GSuite) accounts and Gmail accounts.
• Microsoft — Azure Active Directory, Microsoft 365, Office 365, live.com, etc.
• Slack
• Zoom
• Email / Magic Link — Email authentication allows a “magic link” or short-lived authentication token to be sent to your email address, allowing you to login.
• Open ID Connect — Through the OIDC standard you can delegate authentication to an identity provider such as Okta or One Login.
• Email / Password

Customization: Restricting authentication methods

If you wish to disable certain authentication methods for your workspace, please reach out to support.

Domain binding

Range supports automatic domain binding and just in time account creation.

Domain binding means that if you create a workspace with your work email coyote@acme-corp.com, anyone at acme-corp.com will be able to sign into your workspace. If however, you signed up with coyote445@gmail.com then there will be no domain binding and all users will need to be explicitly invited.

You can see the current configuration on the workspace settings screen.

Customization: Adding additional domains

Range can support multiple domains for your employees, reach out to our support team to have new domains added.

Customization: Disable just in time account creation

If you wish to prevent new users at your company from joining your Range workspace, reach out to our support team. There are two ways of achieving this:

1. Domain binding can be removed, which would allow other users at your company to create their own workspaces.
2. Signup can be disabled which would prevent other users from signing up for Range at all without an explicit invite.

Invites

By default, any Range user can invite someone else into your workspace.

Customization: Restrict invites to same domain

Range can be configured to only allow users that match a set of email domains. This would allow roadrunner@acme-corp.com to be invited but prevent mickey@disney.com from being invited. Each authentication method can be restricted independently. So for example, you could allow an invite to any Google user while locking Microsoft invites to your domain.

Customization: Full control over access

If you need full control over access to Range, we recommend connecting Okta or One Login via OpenIDConnect and then have your account manager disable all other authentication methods.

You will then use Okta and OneLogin for governing access. Even if a Range user invites someone to Range, the new user would only be able to log in if the identity provider granted access.

Disabling users

Range accounts can be closed on the user settings page which will instantly take effect and prevent users from accessing information.

Users authenticated via Google and OIDC, who then have their respective upstream accounts closed, may take 2 hours for sessions to expire.

Users can be programmatically disabled using the UpdateUserState (https://www.range.co) API with an admin’s API key.