SSO Login Considerations
Using Single Sign-On (SSO) with your school username and password, or with your Google account, helps simplify access to SpacesEDU. However, there are a few important considerations when using shared devices.
When you Log Out of your SpacesEDU account, SpacesEDU cannot log you out of the account that you've used for Single Sign-On (e.g., your school's Microsoft account, or your Google account). As a result, teachers or students on shared devices may be brought to the account of the person who was using it before them.
This article outlines:
How do I know if I'm using SSO?
You can determine if you are using SSO based on what happens when you enter your email address to log in.
If you are required to enter a password manually on SpacesEDU, you are not using SSO, and the Log Out option will fully log you out of your account.
You are using SSO:
If you enter your credentials in a pop-up window within your school's login portal
If you are logged directly in to your account after entering your email
If you click the Log in with Google option
If any of those apply to you, you will want to use extra care when accessing your account on shared devices.
Best practices for shared devices
Wherever possible, we recommend setting up shared devices so that each user logs in to the device with their own credentials, and each user logs out fully before allowing someone else to use it - for example, Windows PCs where each user has their own Microsoft account.
If it is not possible to have separate accounts on the device itself, there are a few ways to prevent issues where users are accessing the wrong SpacesEDU account:
You can log in through an Incognito or Private Browsing window, then close it after logging out of SpacesEDU. To access the Incognito feature in Google Chrome:
Click the menu button (3 vertical dots on the upper right of the screen)
Click New Incognito Window
After logging out of an account, ensure that you close all open Incognito windows and open a new one before logging into a different account. Otherwise, the session will stay saved within your incognito window.
If you are using an iOS or Android device, we recommend using the SpacesEDU app available through the App Store and Google Play Store. Logging out of the app will fully log you out of your account, even if you are using Single Sign-on.
You can still log in through a web browser on a mobile device, but if it is a shared device, you'll want to ensure that you clear the cookies before allowing someone else to use it.
For Microsoft accounts, you may also see a prompt to 'stay signed in' when you log in. When using a shared device, ensure this option is unchecked, and that you have closed all browser windows after logging out of SpacesEDU.
You may still be logged in automatically if you attempt to log in to a different account within a short span of time.
The Azure AD login flow also contains logic to hide this option when a sign-in from a shared device, or other high-risk sign-in attempts are detected, but this is not 100% reliable
As an administrator in Azure AD, you can also disable the 'Stay signed in?' option for users. Click here to learn more.
For additional tips on using Google accounts with shared devices, see this article.
When using shared devices, it's also essential that you respond 'No' to any prompts asking if you'd like to save your username/password. Even if you follow all these steps, if your credentials are saved in the browser, others will be able to access your account on that device.
Resolving issues
If you are encountering an issue where one user is being logged in to another's account, you can resolve this by clearing the cookies on the device.
The steps will vary depending on the browser and device you're using:
After clearing the cookies on your device, close your browser, reopen SpacesEDU, and log in. Ensure that you follow the suggestions above, and/or clear your cookies again before allowing another user on the device.
For Microsoft accounts, you can also visit the URL https://login.microsoftonline.com/common/oauth2/logout to force a logout
For Google accounts, you can visit https://myaccount.google.com/ and click the circular avatar at the top right, then Sign Out of All Accounts
Our team is investigating improvements to the logout process, including a function to automatically log users out from their SSO accounts.
In the meantime, by following the tips outlined in this article, you can help avoid issues with access on shared devices - not only for SpacesEDU, but other applications you may use with SSO as well.