Restrict an internal tool to Google Workspace or Microsoft 365 accounts, from your AI agent
Your tool works, and your colleagues want to use it? Connected to while over MCP, your agent deploys it, and your colleagues sign in with the account they already have.
By Aloïs Oddon, co-founder of Nextmap. Facts checked on November 2, 2026.
Prerequisites
- An internal tool: a web app, in any language.
- Your company’s accounts, on Google Workspace or Microsoft 365.
- An AI agent that works in a terminal: Claude Code, Codex, Cursor or Gemini CLI.
Step 1: Give your agent these instructions
Open your agent in your tool’s folder, and paste these instructions into it:
Connect to while with my account (while.sh/agents), then deploy my app.Your agent adds while’s MCP server itself. If it asks you to, restart it. On the first call to while, a page opens in your browser. In Claude Code, if it doesn’t open, type /mcp, choose while, then Authenticate. On that page, choose “A new app”, then click Authorize.
Step 2: Your colleagues sign in with their account
When they open the tool, each person clicks “Continue with Google Workspace” or “Continue with Microsoft 365”, then signs in as usual.
What your agent does
It writes while.yaml, with the line that restricts the tool to your company:
apiVersion: while/v1
project: mon-outil
services:
- name: web
port: 3000
access: internal
health:
path: /
email_domains: [mon-entreprise.fr]Only once, for all your apps, an admin connects Google or Microsoft to while: they register while in the Google Cloud console or in Microsoft Entra1, then verify the domain of your email addresses.
Open the tool to one team
You, to your agent: Restrict the tool to the accounting group.
Your agent declares the group in while.yaml, and the tool opens only to its members.
Know who is signed in
You, to your agent: Show the name of the person who is signed in.
Your tool receives the name and email address of each person signed in, in the headers of their requests.
Share with a customer, protected by a password
You, to your agent: Open the tool to our customer, with a password.
Your agent makes the app private, then, on the app’s page in while, you create a link valid for 1, 7 or 30 days, with a password your agent will never see.
Add a database
You, to your agent: Add a PostgreSQL database.
Your agent declares the database in while.yaml, and its address reaches your code in DATABASE_URL. It is backed up every day, and can go back to a precise moment if needed.
Move to your own domain
You, to your agent: Put the tool on tools.acme.com.
Your agent declares the domain, you add the DNS records it gives you, and the HTTPS certificate follows.
Go back to the previous version
You, to your agent: Go back to the previous version.
In the 30 minutes after a deployment, the previous version comes back in a second. After that, it takes a few seconds. Once the previous version is back, your agent reads what broke in while’s logs, fixes it and deploys again.
In the docs: Internal access, Roles and permissions, PostgreSQL databases, Custom domain and Versions and rollback.
Next steps
Sources
- Microsoft Learn, identity for Microsoft 365 accounts (Microsoft Entra ID), accessed November 2, 2026