School sign-in

How school sign-in works

WriteWise uses OpenID Connect, the identity layer built on OAuth 2.0, to authenticate a user with their school account. The school does not create or maintain its own app registration, client secret, or signing certificate.

After the identity provider authenticates the user, WriteWise checks the returned identity against the school configuration before creating a WriteWise session. The configuration differs between Google Workspace and Microsoft Entra ID.

Google Workspace

Google Workspace describes WriteWise as a third-party app that uses Sign in with Google. WriteWise is registered as an OAuth 2.0 web application and requests only the OpenID Connect identity scopes openid, profile, and email. These provide the identity information needed to sign the user in. WriteWise does not request access to Gmail, Google Drive, Google Classroom, calendars, or contacts.

A Google Workspace administrator controls access in the Google Admin console under Security → Access and data control → API controls → Manage Third-Party App Access. Search for WriteWise, then configure access for the staff and student organizational units that will use it.

See Google's official guidance on controlling third-party app access.

Microsoft Entra ID

WriteWise uses a WriteWise-owned multitenant application registered with the Microsoft identity platform. When the school's tenant consents to or first uses that application, Microsoft Entra creates an Enterprise application, also called a service principal, in the school's tenant. The school does not create a separate app registration or provide WriteWise with a client secret.

WriteWise requests the OpenID Connect identity scopes openid, profile, and email. If the school's consent policy does not allow users to consent, an eligible Entra administrator reviews the requested permissions and grants tenant-wide admin consent. Microsoft documents the required roles and process in Grant tenant-wide admin consent to an application.

Once onboarding and any required consent are complete, users select “Sign in with Microsoft” and authenticate with their school account.