Org Workspace Integration (account provisioning)
Org Workspace Integration connects your Google Workspace or Microsoft 365 tenant to GreekManage. Once an account exists, admins and chapter officers can retry a failed provision, suspend or reactivate the account, and reset its password — and members can reset their own.
Creating accounts automatically is a separate opt-in. Enabling the integration does not, on its own, create anything: you additionally choose whether a PNM crossing into brotherhood auto-creates a provider account (e.g. first.last@yourchapter.org) with a forced password change on first sign-in. That lets an organization with an existing roster manage accounts it created by hand without arming crossings.
This card was previously named "Account Provisioning" and lived under PNM Settings — it moved to Settings → Modules because it configures an org-wide identity-provider connection, not something specific to recruitment.
Configuring the connection
Settings → Modules → Org Workspace Integration:
- Identity provider — Google Workspace or Microsoft 365.
- Domain — the tenant domain new accounts are created under.
- Email pattern —
first.last@domain,flast@domain, orfraternal-name@domain. - Integration enabled — makes the connection live. Linking, suspend/reactivate, and password reset (both admin-initiated and member self-service) all require this. Turning it off does not delete anything, but it does stop you managing existing accounts until you turn it back on.
- Auto-create member accounts on crossing — separately decides whether a crossing PNM gets an account made for them. It requires the integration to be enabled, and stays visible but greyed out until it is, so you can always see whether enabling the integration would start creating accounts.
Save writes the config immediately; a confirmation toast reads "Integration settings saved".
:::tip Managing accounts without arming crossings To administer accounts you created directly in your provider's admin console — linking, suspending, resetting — turn Integration enabled on and leave Auto-create off. Crossings then create nothing, and no seats are consumed unexpectedly. :::
Per-member actions
Open a member's detail page (Members → [member]) as an admin or the officer of their chapter. If the member has a provisioned account, a Provisioned Account card shows their provider address, status (pending / success / failed / suspended), and when they were provisioned.
| Action | Available when | What it does |
|---|---|---|
| Retry | Status is failed | Re-attempts provisioning against the configured provider. |
| Suspend | Status is success | Suspends the provider account (blocks sign-in on the provider side; the record itself isn't deleted). |
| Reactivate | Status is suspended | Restores provider sign-in. |
| Reset password | Status is success or suspended | Opens the reset dialog (below). |
| Link | No provisioning record exists | For an account created directly in your provider's admin console — links it so status, suspend, and reset apply to the real account instead of creating a duplicate. |
Changing a membership status does not touch the provider account
Suspending a provider account is only ever an explicit action — someone
clicks Suspend on the member's card. Marking a member inactive or
disaffiliated in GreekManage changes their GreekManage record and nothing
else: their Google Workspace or Microsoft 365 account keeps working, and their
email and files stay accessible.
This is deliberate. Membership status is a records field, edited routinely and by many people — an officer correcting a roster should not be able to cut off someone's email as a side effect. If you want a departing member's account suspended, suspend it explicitly, which leaves an audit-log entry naming who did it.
:::note Changed in v0.73.13
Before v0.73.13, moving a member into inactive or disaffiliated did
automatically suspend their provider account, and moving them back reactivated
it. That link has been removed. If you were relying on it as your off-boarding
step, suspension is now a separate click.
:::
Resetting a provisioned account's password
A password reset must never mail the new temporary password to the account being reset — that's the mailbox the member is usually locked out of in the first place, which is the normal reason to ask for a reset at all. GreekManage resolves a destination for every reset before it changes anything, and refuses rather than send credentials nowhere useful.
As an admin or officer
Click Reset password on the member's Provisioned Account card. The dialog opens by telling you where a blank destination would go — either the addresses that would be used, or "No address on file can receive this — type a destination below." You don't have to submit and read an error to find out which situation you're in.
The destination field itself:
- Leave it blank to use a verified address already on the member's profile (primary address first, excluding the provisioned address itself).
- Type an address the member can reach right now — useful when they're locked out of the mailbox on file and haven't verified an alternate address yet.
Click Send. On success the dialog closes and a toast reads "A new temporary password will be sent to <address>." — future tense, because delivery happens asynchronously in the background, not as part of this request.
If there's no verified address to fall back to and you left the field blank, the request is rejected with "This member has no verified address we can reach. Supply a destination to send the new password to." The dialog stays open — type a reachable address and send again, or have the member verify an alternate email on their profile first (Member detail → Profile → Emails) so future resets don't need a manual override.
An address that's on your organization's suppression list (hard-bounced or previously unsubscribed) is also rejected, even as an explicit override — the resolver checks suppression before anything is sent.
Keeping the address you typed
Once you've typed a destination, the dialog offers "Also keep this as a recovery address." Tick it and the address is attached to the member's account so future resets have somewhere to fall back to, instead of prompting you again every time.
It is saved unconfirmed, and it does nothing until the member confirms it. They receive a separate email naming your organization and containing a 6-digit code, which they enter under Account Settings → Email addresses. Until then the address:
- cannot be used to sign in to GreekManage,
- cannot receive a GreekManage password-reset link,
- is not used as a credential destination — a later blank-destination reset still won't resolve to it.
That restriction is the point, not an inconvenience. A confirmed address is simultaneously a login identity, a password-reset target reachable from the public "forgot password" page, and a credential destination. If ticking a checkbox during a routine reset could mint one, an officer could attach an address they control to a member's account and then take the account over through the ordinary reset flow. Requiring the member — the person whose account it is — to confirm is what closes that path. In practice the confirmation lands in the same inbox they're already opening to read the temporary password.
The reset and the save are reported separately, because they're independent: the password is already on its way when the save is attempted. If the address is already linked to another account, or the member has too many unconfirmed addresses pending, the toast says the password was still sent and the address was not kept, with the reason. The reset is never blocked by a failed save.
Leaving the field blank means "use the profile", so there's nothing new to keep — the checkbox only appears once you've typed something.
Every address attached this way is recorded in the audit log with the admin who added it and the member it was added to.
As the member (self-service)
A member with an active provisioned account can reset its password themselves from Account Settings → Provisioned Account. Unlike the admin dialog, this is a picker, not a free-text field — the member chooses from their own verified email addresses (delivery_choices), never types an arbitrary destination. That's deliberate: a member may only redirect their own credentials to an address they've already proven they own, so a hijacked session can't be used to steal the provider account by rerouting the reset email elsewhere.
If the member has no verified address on file (their only address is the provisioned one itself, or they haven't verified anything else), the Reset password button is disabled with "No reachable address on file. Ask an officer to reset this for you." — that's when the admin flow above, with an explicit destination, is the only path.
Why a record can show a warning even though it says "success"
Provisioning creates the provider account first and delivers the welcome email with the temporary password second. If there was no reachable address at provisioning time, the account still gets created — the record stays success — but a warning appears: "Account created but credentials could not be delivered — no reachable address on file. Use Reset password below to send new credentials to a reachable address." This is not a failure state; it just means nobody has the current password yet. Use Reset password with an explicit destination to deliver one.
The same degraded state shows as a "Credentials undelivered" note in the Org Workspace Integration card's recent-provisioning log, with the detail available on hover.
Errors and edge cases
"No verified address we can reach" on a blank-destination reset. The member's only verified UserEmail is the provisioned address itself (or they have none). Supply an explicit destination, or have them verify an alternate address first.
An explicit destination is rejected even though it looks fine. Two possibilities: it matches the provisioned address (not allowed — that's the exact circular delivery this feature exists to prevent), or it's on the suppression list from a prior hard bounce or unsubscribe.
A member says they never got the reset email. Check whether the destination used was suppressed — suppressed sends are dropped silently by the mailer rather than bouncing visibly. Confirm the destination shown in the success toast, and check apps/email_delivery's suppression list for that address.
Self-service reset button is disabled. The member has no other verified address besides the provisioned one. An admin or officer must reset with an explicit destination, or the member needs to add and verify an alternate email under their own profile settings first.
"It was not saved: that address is already linked to an account." Email addresses are unique across all of GreekManage, so an address attached to anyone else — including as somebody's unconfirmed address — can't also be attached here. The password reset still went out; only the save was refused.
"It was not saved: this member already has the maximum number of unconfirmed addresses." Five unconfirmed addresses are allowed per member. Because an unconfirmed address also reserves that address against every other account, the cap is what stops the field being used to reserve addresses in bulk. Have the member confirm or remove one (Account Settings → Email addresses) and try again. The password reset itself still went out.
I kept an address, but the next reset still says there's no reachable address. The member hasn't confirmed it yet. Until they enter the code, it deliberately isn't a credential destination. Ask them to check the inbox for that address, or resend from their Account Settings.
Related
- Module enablement — Org Workspace Integration itself isn't a licensable module; it's always available under Settings → Modules.
- Inviting admins — admin password reset for the GreekManage sign-in itself (a different credential than the provider account covered here).
- Identity providers (SSO) — SSO sign-in into GreekManage, distinct from the provider account this page provisions.
Last verified against v0.73.17 (2026-08-16). Relocated from PNM Settings in v0.71.2; destination-aware reset shipped then. Keeping a typed destination as an unconfirmed recovery address, and showing what a blank destination resolves to, shipped in v0.73.17 (#911).