---
title: "Internal tool: sign in with Google or Microsoft 365"
url: https://while.sh/en/guides/internal-tool-company-sign-in/
author: "Aloïs Oddon, co-founder of Nextmap"
updated: 2026-11-02
---

# Restrict an internal tool to Google Workspace or Microsoft 365 accounts, from your AI agent

Your tool works, and your colleagues want to use it? Connected to while over MCP, your agent deploys it, and your colleagues sign in with the account they already have.

## Prerequisites

- An internal tool: a web app, in any language.
- Your company's accounts, on Google Workspace or Microsoft 365.
- An AI agent that works in a terminal: Claude Code, Codex, Cursor or Gemini CLI.

## Step 1: Give your agent these instructions

Open your agent in your tool's folder, and paste these instructions into it:

```text titre="Instructions"
Connect to while with my account (while.sh/agents), then deploy my app.
```

Your agent adds while's MCP server itself. If it asks you to, restart it. On the first call to while, a page opens in your browser. In Claude Code, if it doesn't open, type /mcp, choose while, then Authenticate. On that page, choose "A new app", then click Authorize.

## Step 2: Your colleagues sign in with their account

When they open the tool, each person clicks "Continue with Google Workspace" or "Continue with Microsoft 365", then signs in as usual.

## What your agent does

It writes while.yaml, with the line that restricts the tool to your company:

```yaml titre="while.yaml"
apiVersion: while/v1
project: mon-outil
services:
  - name: web
    port: 3000
    access: internal
    health:
      path: /
    email_domains: [mon-entreprise.fr]
```

Only once, for all your apps, an admin connects Google or Microsoft to while: they register while in the Google Cloud console or in Microsoft Entra (source 1), then verify the domain of your email addresses.

## Open the tool to one team

> You, to your agent: Restrict the tool to the accounting group.

Your agent declares the group in while.yaml, and the tool opens only to its members.

## Know who is signed in

> You, to your agent: Show the name of the person who is signed in.

Your tool receives the name and email address of each person signed in, in the headers of their requests.

## Share with a customer, protected by a password

> You, to your agent: Open the tool to our customer, with a password.

Your agent makes the app private, then, on the app's page in while, you create a link valid for 1, 7 or 30 days, with a password your agent will never see.

## Add a database

> You, to your agent: Add a PostgreSQL database.

Your agent declares the database in while.yaml, and its address reaches your code in `DATABASE_URL`. It is backed up every day, and can go back to a precise moment if needed.

## Move to your own domain

> You, to your agent: Put the tool on tools.acme.com.

Your agent declares the domain, you add the DNS records it gives you, and the HTTPS certificate follows.

## Go back to the previous version

> You, to your agent: Go back to the previous version.

In the 30 minutes after a deployment, the previous version comes back in a second. After that, it takes a few seconds. Once the previous version is back, your agent reads what broke in while's logs, fixes it and deploys again.

## Next steps

- [Deploy a Next.js app](/en/guides/deploy-nextjs/)
- [Deploy a Node.js API and its PostgreSQL database](/en/guides/deploy-node-api-postgresql/)
- [Compare the hosts that have an MCP server](/en/comparisons/mcp-hosting-claude-code/)

## Sources

1. [Microsoft Learn, identity for Microsoft 365 accounts (Microsoft Entra ID)](https://learn.microsoft.com/en-us/microsoft-365/enterprise/deploy-identity-solution-identity-model), 2026-11-02

## Questions

### Do I need to code a sign-in page?

No, it's already there, and your tool receives the name of the person signed in.

### Which plan do I need?

It comes with the Pro and Enterprise plans.

### Can a contractor get in?

Yes, with their email address, if they sign in with Google or Microsoft. Otherwise, through a link with a password that you create for them.