> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Form authentication
> Choose who can open a Studio form, how Triggr matches the person to a client, and what your workflow learns about them.
Form Authentication decides who can open a form and whether your workflow learns which client the person works for. In the form designer, click **Form Authentication**, choose a type, then click **Save** at the bottom of the designer.
| Type | Who can open the form | Workflow knows the client |
| - | - | - |
| None | Anyone with the link | No |
| Password | Anyone with the link and the form's password | No |
| Microsoft | Client staff whose Microsoft tenant ID is on the client | Yes |
| Google | Client staff whose Google Workspace domain is on the client | Yes |
| Internal | Your own Studio team | Only with Manually Set Client |
## Set up a client-facing form
Add a `microsoftTenantId` variable to each client, as in [Clients and variables](/studio/clients/clients-and-variables#give-it-variables). Clients connected through [GDAP](/integrations/microsoft-graph/gdap-service-account) or [SAM](/integrations/microsoft-graph/sam) already have it.
Click **Form Authentication**, choose **Microsoft** and click **Save** at the bottom of the designer.
In the workflow designer, drag **Set Client From Form** (under Client) onto the canvas straight after the Trigger. Later steps act for the submitter's client and can read its variables, such as `{{ ctx.client.name }}`.
Save the form first: the test opens the saved version. Click **Share Form > Impersonate**, choose a Client and a Microsoft user, and click **Open as this user**. The form opens as that person for 30 minutes; submitting runs the workflow for real, with `ctx.metadata.custom.impersonatedByEmail` set to your email.
In Share Form, click **Copy** next to Public Form URL and send it to the client. Their staff see this:
## How each type works
### None and Password
None opens straight away. Password asks for the form's password (“This form requires a password to access”); the eye icon in the panel reveals it, and changing it locks out anyone who has the form open. Neither type gives the workflow a person or a client.
### Microsoft
Visitors click Sign in with Microsoft and pick their work account (personal accounts such as outlook.com can't get in). Triggr matches the sign-in's tenant ID to a client's `microsoftTenantId`, ignoring case and spaces; with no match they see “you do not have permission to access this form”. Keep each tenant ID on one client.
Without restrictions, anyone in a matched tenant can open the form. Turn on one or more to narrow it; a person who matches any one gets in.
| Option | Lets in |
| - | - |
| Restrict to usernames | People listed under Allowed Usernames, by sign-in name (UPN) or email, ignoring case |
| Restrict to groups | Members of the Entra group object IDs under Universal group IDs (any client) or, after + Add override, under a client's Per-client overrides. With overrides only, clients without one are refused |
| Restrict to group names | Members of a group with this display name in their own tenant, found through your Microsoft integration, so the client must be connected; group changes take up to 15 minutes to apply |
Nested groups count. A blank row in any list saves but matches no one.
Optional Authorization adds a database check: choose an **Authorization Database** (from Data > Databases) and enter **Authorization SQL** that counts rows for the person, who gets in only if it returns more than 0. Each `{{ctx.metadata.microsoftUser.…}}` value is passed as a parameter. Apply Default fills in:
```sql theme={null}
SELECT COUNT(*) AS count FROM users WHERE email = '{{ctx.metadata.microsoftUser.upn}}'
```
### Google
Visitors click Sign in with Google and pick their work account. Triggr matches the Workspace domain to the client whose `googleWorkspaceDomain` variable lists it (separate several with commas: `acme.com,acme.co.uk`). A personal account sees “a Google Workspace account is required to access this form”; a domain on no client, or on two, sees “you do not have permission to access this form”.
Restrict to emails and Restrict to Workspace domains narrow the form; a person who matches either gets in. Optional Authorization works as for Microsoft, with `{{ctx.metadata.googleUser.email}}` and so on.
### Internal
Your team opens the form from Complete Form in the designer or Complete on Forms; anyone else sees “This form is for internal use — sign in with your staff account to continue”. Internal forms have no Share Form dialog or List on Homepage option. Turn on **Manually Set Client** so your team picks a client and clicks Next before the form opens; without it, the workflow gets no client.
Preview Before Submit, under Submission for every type, shows the person their answers before they submit.
## What the workflow gets
Every run a form starts has `ctx.metadata.source` (`form_submission`), `ctx.metadata.formId` and `ctx.metadata.submissionId`. Signed-in types add the person and, with Set Client From Form, the client:
| Type | Person | Client |
| - | - | - |
| Microsoft | `ctx.metadata.microsoftUser`: `oid`, `email`, `name`, `givenName`, `familyName`, `tenantId`, `preferredUsername`, `upn`, `roles`, `groups` | The client whose `microsoftTenantId` matches `tenantId` |
| Google | `ctx.metadata.googleUser`: `sub`, `email`, `name`, `givenName`, `familyName`, `domain`, `picture`. The client's ID is also in `ctx.metadata.tenantId` | The client matched at sign-in |
| Internal | `ctx.metadata.internalUser`: `id`, `email`, `name`, `firstName`, `lastName`, `username`. The chosen client's ID is in `ctx.metadata.internalFormTenantId` | The client chosen under Manually Set Client |
| None, Password | Nothing | None |
For example, send the confirmation to `{{ ctx.metadata.microsoftUser.email }}`; if the account has no email address, `email` holds its sign-in name.
## Microsoft sign-in and admin consent
Sign-in uses Triggr's multi-tenant Microsoft Entra app (application ID `75bd83ba-fbd3-47da-b68f-4adab663015f`), which asks only for `openid`, `profile`, `email` and the delegated Microsoft Graph permission `User.Read`. Each person accepts this the first time they sign in. If the tenant [restricts user consent](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent), an admin there (Cloud Application Administrator or above) [grants consent for the organisation](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent) once, for example by signing in to the form and ticking **Consent on behalf of your organization**.
## Your homepage and forms domain
Set these up in [Branding and client portal](/studio/settings/branding-and-portal).
* A Custom Forms Domain changes form links to `https://forms.yourmsp.com/forms//` and gives you a homepage at `https://forms.yourmsp.com`; sign-in works on it with no extra setup.
* List on Homepage shows a form on that homepage to anyone; each form still asks for its own sign-in.
* Authenticate on Telescope homepage (Settings > Branding > Telescope Authentication) makes visitors sign in with Microsoft first and shows them only the None forms and the Microsoft forms they'd be let into.
## FAQ
Guests sign in as their home organisation, so Triggr matches the client whose `microsoftTenantId` is their home tenant, not the tenant they're a guest in.
The client of the account they sign in with. To switch, they click Logout at the top of the form, open the link again and pick the other account.
Turn on **Restrict to group names** and add the group each client uses, such as `Managers`. For a handful of people, use Restrict to usernames.
An Internal form with Manually Set Client: they choose the client before the form opens, and Set Client From Form picks it up.
Preview uses the form's own sign-in and never submits. To try a Microsoft or Google form as a client user, use Share Form > Impersonate.
## Troubleshooting
Microsoft: no client has the person's tenant as `microsoftTenantId`, they fail a restriction or the Authorization SQL, or a restriction list has a blank row. Google: their domain is on no client or on two, or they fail a restriction.
The person signed in with a personal Google account. They need their work Google Workspace account.
The password is wrong, or it changed after the person opened the form. They reload the form and enter the current one.
The Microsoft sign-in lasts about an hour in that tab and has expired. Reload the form, sign in again and re-enter the answers.
The browser blocked the sign-in pop-up, or it was closed or left open for over 10 minutes. Allow pop-ups for your forms domain and try again.
The form was opened on a domain that isn't your current Custom Forms Domain. Send the link from Share Form again.
A restriction is on with an empty list. Add an entry or turn it off. A Google domain needs a dot and no `@`, and a Password form's password can't be empty.
The form doesn't identify a client: it's None, Password, or Internal without Manually Set Client. If it fails with “no tenant found with microsoftTenantId variable equal to …”, add that tenant ID to the client's `microsoftTenantId` variable.
The person isn't signed in to Studio. Open the form from Complete while signed in.
Add the client's `microsoftTenantId` variable and connect the client through your Microsoft integration, which Impersonate uses to list its users. For Google, type the user's email; its domain must be in the client's `googleWorkspaceDomain`.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.