Signing in to our apps

What the sign-in link does

When we give you access to one of our apps, such as Bearing for project and pursuit work, we ask Microsoft to invite you. Microsoft then sends the email, not us.

1. You get an email from Microsoft Invitations on behalf of Cornerstone Cyber. If it lands in junk, your contact at Cornerstone Cyber can send you the same link directly.
2. You press Accept invitation. Microsoft checks your email address and sends you to the right place to prove who you are.
3. If your organisation uses Microsoft 365, you sign in with the work account you already have, on your own organisation's sign-in page. Nothing new is created.
4. If it does not, Microsoft emails a one-time code to that address. You enter the code and you are in. Each code works for 30 minutes and once only.
5. You agree to the permissions Microsoft shows you, and the app opens on the work we have shared with you.

The invitation is made for one named person and one email address. It opens only what we chose for you, such as a particular project or pursuit, and whether you see pricing. It does not open our email, files, Teams or Azure.

How a Microsoft identity works

Your identity stays with your own organisation. Our directory holds a guest entry for you: your name, your email address and what you may open. It holds no password.

• Your organisation checks your password and your sign-in steps, not us. We cannot see, store or reset your password.
• Your organisation stays in control. If it turns off your account, for example when you leave, you can no longer sign in to our apps either.
• Guest accounts have limited permissions by Microsoft's design. A guest sees the work we share, not our systems.
• We can remove your access at any time, and we do when the work ends.

This is Microsoft's business-to-business guest access, known as Microsoft Entra B2B collaboration. Organisations around the world use it to work with partners and customers. Microsoft documents it in full on Microsoft Learn, including the invitation steps and the one-time code.

Why signing in with Microsoft is safe

• You type your password only into Microsoft's sign-in page, or your own organisation's. Our apps never receive it.
• Microsoft hands our app a signed token that says who you are. The token proves the sign-in without carrying your password.
• Every connection is encrypted, with TLS 1.2 as the minimum.
• Microsoft records each sign-in, so access can be reviewed and traced.
• Microsoft runs the protections at the front door, such as locking out password-guessing attacks, at a scale no single company could match.

How our single sign-on works

One Microsoft sign-in opens each of our apps. None of our apps keeps its own passwords.

• The Microsoft Azure platform checks your sign-in before any request reaches our code.
• What you see is decided by our server and our database, not by hiding a button. A field you may not see, such as pricing, is never sent to your browser.
• Our own people sign in with single sign-on and multi-factor authentication.
• Admin work uses separate admin accounts. Our production environment can be changed only by a few named admin accounts, for a limited time, with a stated reason and multi-factor authentication.

Where your data lives

Our apps and their data are hosted in Microsoft Azure in Australia. Our email, files and identity run on Microsoft 365 in Australia. Data is encrypted at rest and in transit. The full list of services that process data for us is in our trust centre.

Setting up your identity well

• Use your work email, not a personal one. Your organisation then controls the account, and access ends when your job does.
• If your organisation uses Microsoft 365, there is nothing to create. Sign in as you do every day.
• Turn on multi-factor authentication. Microsoft Authenticator or a passkey is the strongest everyday choice. A text message is better than nothing.
• If you set a password for a new Microsoft account, use a long passphrase you use nowhere else, kept in a password manager.
• One person, one identity. Never share a sign-in or a one-time code, and never sign in on behalf of a colleague. Ask us to invite them.
• Tell us when somebody leaves or changes role, so we remove their access promptly.

How to tell a real sign-in from a fake

• The sign-in page is at login.microsoftonline.com, or your own organisation's usual sign-in page. Check the address bar before you type a password.
• We will never ask for your password or a one-time code by email, phone or chat.
• An invitation never asks for payment or card details.
• Not expecting an invitation? Do not press the link. Call your contact at Cornerstone Cyber or email security@cornerstonecyber.com.au.

cornerstonecyber.com.au/trust-sign-in · Trust centre: cornerstonecyber.com.au/trust