Corporate Taxi SSO Login with Google and Microsoft 365

## How does CabsOn corporate SSO login actually work? Your staff go to business.cabson.uk and enter their work email address. Our login page detects the domain (for example @acme.co.uk), looks up the SSO configuration your admin has registered against that domain, and redirects the browser to Google or Microsoft. Your identity provider authenticates the user — running whatever MFA prompts, device checks, and conditional access rules you already have in place — and redirects back to us with a signed token. We verify the token, match it to a corporate user record, and drop the traveller straight into the booking flow. No CabsOn password is ever typed, stored, or reset. The whole exchange takes about two seconds. Behind the scenes we are using OAuth 2.0 and OpenID Connect. That is the same protocol family that Google Workspace and Microsoft 365 use to secure their own products, and it means your existing security investments — the MFA app your staff already have, the device trust rules you already publish — apply to CabsOn automatically. We do not run a parallel authentication stack, and we deliberately do not want to. Your directory should stay the system of record for who is and is not an employee. ## What identity providers does CabsOn support? Today: Google Workspace and Microsoft 365 (formerly Office 365) through OAuth 2.0 and OpenID Connect. These two providers cover the overwhelming majority of UK business identity stacks, from small independent hotels running Microsoft 365 Business Basic through to mid-market law firms on Google Workspace Enterprise. Not yet: SAML 2.0 assertions from Okta, Ping Identity, JumpCloud, self-hosted ADFS, or other pure SAML providers. We are building SAML 2.0 support and expect to ship it in a coming portal release. If your procurement mandates SAML today, please tell us during evaluation and we will let you know the current pilot timeline honestly. We would rather lose a deal on capability than win one and disappoint you at go-live. Also not yet: SCIM 2.0 push provisioning. Directory sync in CabsOn is pull-based — we ask your identity provider for the current state of your user list on a scheduled cycle, rather than accepting a push. Most customers cannot tell the difference. ## Does SSO change how we book rides? No — the booking experience is identical after login. Your staff still see the same Book A Ride screen, the same fleet options, the same fare estimates, the same UK-focused pickup coverage. What changes is who they are when they arrive at that screen. Because the login was directory-verified, we know which cost centre they belong to, which spending limit applies, and which manager needs to approve rides above that limit. All of that context flows into the booking without the traveller having to select it manually. For finance teams this is the quiet win. On a manual system you rely on the traveller to pick the right cost code every time, and any Monday-morning finance lead can tell you how well that works in practice. On SSO with directory-mapped cost centres, the ride is tagged correctly at source, and the monthly consolidated invoice comes out reconciled without a spreadsheet exercise. ## How does auto-provisioning work for new employees? The first time a new employee signs in via SSO, we create their CabsOn corporate user automatically. Admins control the rules from the SSO settings screen in the corporate portal: - **Domain allowlist** — restrict provisioning to specific email domains. Useful if you share a Microsoft tenant with a payroll bureau or an acquired subsidiary whose staff should not have CabsOn access. - **Directory group mapping** — link Google Groups or Microsoft Entra groups to CabsOn cost centres. A user in the acme-legal group is auto-created against the Legal cost centre; a user in acme-events lands in the Events cost centre. The rules are evaluated in priority order and the first match wins. - **Default spending limit** — set a per-ride cap that applies to newly provisioned users until a manager assigns something more specific. Common patterns are 30 pounds for staff and 60 pounds for named client-facing roles. - **Manual approval mode** — for stricter environments, hold every first login for admin review before the account is activated. Slower, but auditable. ## How does auto-deprovisioning work when someone leaves? Every twelve hours we compare our list of active corporate users against your Google Workspace or Microsoft 365 directory. Anyone who has been suspended, deleted, or moved into a leaver group in your directory is automatically disabled in CabsOn. That means: - They cannot log in through SSO. - They cannot log in through any other method (local passwords are disabled for SSO-managed domains). - They cannot be added as a passenger on a new booking. - Their historical booking data is retained for the VAT window required by HMRC and for your own reporting. An admin can also trigger an on-demand sync from the SSO settings screen. Most customers use this the moment HR confirms an exit, especially for higher-risk offboardings. Between scheduled sync and manual trigger, a leaver's window of residual access is typically minutes rather than days — a meaningful improvement over the industry norm of "we'll get to it in next month's access review". ## Is CabsOn corporate SSO GDPR compliant? Yes. We operate under UK GDPR and the Data Protection Act 2018 and take a minimum-necessary approach to identity data. Through SSO we ingest only the fields we need to bill and support the ride: display name, work email, employee ID where your directory provides one, and group membership for cost-centre mapping. We do not pull calendars, contacts, files, or any other data from your Google Workspace or Microsoft 365 tenant, and the OAuth consent screen shows precisely which scopes we ask for so your IT team can review them before installing. We publish a Data Processing Agreement for corporate customers, and we can complete standard vendor security questionnaires (including a filled Cyber Essentials-aligned response) on request from your procurement team. ## How does this compare to Uber for Business, Bolt Business, and Addison Lee? Honestly, on identity federation the field is more even than the marketing suggests. Uber for Business supports SSO with Google, Microsoft, Okta and SAML for enterprise customers — they are ahead of us on SAML today. Bolt Business currently focuses on email-plus-password with domain restrictions; SSO is a growing area but coverage varies by market. Addison Lee, as a specialist UK premium operator, has strong invoicing and traveller controls but their SSO story is enterprise-contract-led rather than self-service. Where we think CabsOn wins for UK small and mid-sized businesses is the combination: OAuth SSO you can turn on yourself in fifteen minutes, mapped to cost-centre and budget controls that reflect a UK VAT-compliant invoice you actually recognise. Where the giants are ahead is enterprise SAML federation and, in Uber's case, sheer market coverage outside the UK. If you are a UK company running Google Workspace or Microsoft 365 and you want directory-verified corporate travel without a six-month IT project, we are competitive. If you are a global 5,000-seat enterprise with a SAML-only identity policy, we would ask you to wait for our SAML release or trial us alongside an incumbent. ## What does SSO cost on a CabsOn corporate account? SSO is included on every corporate account at no extra charge. There is no per-seat identity fee, no premium tier that gates SSO behind a higher plan, and no minimum ride volume required to enable it. We took the view that identity federation is table stakes for a credible corporate travel product, not a paywall opportunity. The economics of managing password resets across a growing customer base are worse for us than the economics of properly delegated authentication, so this is genuinely a mutual win rather than a marketing line. You pay for rides. The corporate portal, cost-centre controls, monthly VAT invoicing, spend approvals, reporting, and SSO are all part of the account.