The queues are still moving.

Work items advance while you are away — but never past the points you kept for yourself.

01 Identity is your provider's job. MFA, conditional access and device policy stay where your organisation already manages them. We never see a password.
02 Authorisation is ours. Your permissions are resolved per workflow and per queue from the groups you belong to — including groups mapped from your single sign-on claims.
03 One environment at a time. After sign-in you enter the environment you were granted. Being an administrator in one is never an administrator anywhere else.
04 Everything you do is attributed. Each save, route and approval is stamped with your identity and marked as a human decision — the mark an agent cannot produce.

Sign in

Use the identity provider your organisation has configured.

Continue with Google Continue with Microsoft

You will be taken to your provider to sign in. WorkflowHub receives a signed identity token and never a password.

Agents do not sign in here. A fleet agent authenticates with its own API key. The key acts as a named account, resolves exactly that account's permissions, and is refused at every human checkpoint — the same as it would be with no permission at all.