Station Identity Provider Setup Guide
Setting up your station's sign-in for WATCHDESK
WATCHDESK uses your station's existing Google Workspace or Microsoft 365 account for sign-in. Members log in with their department email — no extra passwords to remember. This guide walks you through creating the credentials WATCHDESK needs.
https://watchdesk.org/auth/google/123/callback —
you cannot complete the setup without it. If you received a setup email, the URL is included there.
Select the platform your station uses for email
Choose this if your station uses Google Workspace (Gmail, Google Drive, etc.)
for department email — e.g., members have name@yourdomain.org addresses managed through Google.
Choose this if your station uses Microsoft 365 (Outlook, Teams, SharePoint, etc.)
for department email — e.g., members have name@yourdomain.org addresses managed through Microsoft / Azure AD.
Make sure you have these ready
yourdomain.org)yourdomain.org)Follow each step in order. Click through to the next when done.
Open your web browser and go to the address below. Sign in with your Google Workspace administrator account (the one that manages your station's emails).
If this is your first time using the Google Cloud Console, you'll be asked to agree to the Terms of Service — check the box and click Agree and Continue.
Google may also ask you to set up a billing account before you can create a project. If so, click "Enable Billing" or "Create Billing Account" and follow the prompts. You'll need to enter a payment method (credit card), but you will not be charged.
If you already have a billing account set up, you can skip this step.
At the very top of the page, you'll see a project dropdown (it may say "Select a project" or show an existing project name). Click it, then click "New Project".
Name the project WATCHDESK and click Create. Wait a few moments, then make sure the new project is selected in the dropdown at the top.
In the left sidebar, click APIs & Services, then click Library. In the search bar, type Google People API and click on it when it appears.
Click the blue "Enable" button. This allows WATCHDESK to read basic profile info (name and email) when members sign in. That's the only data it accesses.
In the left sidebar, click APIs & Services, then click OAuth consent screen.
Select "Internal" and click Create.
You only need to fill in three fields:
WATCHDESKYou can skip the logo and app domain fields. Scroll down to Authorized domains and add watchdesk.org — this is required because the sign-in redirect points to the WATCHDESK website. Then click Save and Continue.
You don't need to add anything on this page. Just click Save and Continue.
Review the summary and click Back to Dashboard. The consent screen setup is done.
In the left sidebar, click APIs & Services, then click Credentials.
At the top of the page, click "+ Create Credentials", then choose "OAuth client ID" from the dropdown menu.
Fill in these two fields:
Web application from the dropdownWATCHDESKScroll down to the "Authorized redirect URIs" section and click "+ Add URI". Paste in the callback URL that the WATCHDESK administrator gave you. It looks like this:
Click "Create". A dialog will pop up showing two values:
.apps.googleusercontent.comCopy both values now and save them somewhere safe. You'll send them to the WATCHDESK administrator in the next step.
Follow each step in order. Click through to the next when done.
Open your web browser and go to the address below. Sign in with your Microsoft 365 administrator account.
In the search bar at the top of the page, type Azure Active Directory and select it from the results. (It may also appear as Microsoft Entra ID — that's the same thing with a new name.)
In the left sidebar, click "App registrations".
At the top of the page, click "+ New registration". Fill in the following:
WATCHDESKStill on the same page, find the "Redirect URI" section. Select "Web" from the dropdown, then paste in the callback URL the WATCHDESK administrator gave you. It looks like this:
Click "Register". You'll be taken to the application's overview page. Stay on this page — you'll need it for the next step.
On the overview page, you'll see two important values. Copy both of them and save them somewhere safe:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxIn the left sidebar of your app registration, click "Certificates & secrets".
Click "+ New client secret" and fill in:
WATCHDESKClick "Add".
A new row will appear in the table. Look for the "Value" column (not the "Secret ID" column) and copy it right away.
In the left sidebar, click "API permissions".
You should already see Microsoft Graph > User.Read listed as a delegated permission. This is added automatically and is all WATCHDESK needs.
If it's not listed, click "+ Add a permission" → "Microsoft Graph" → "Delegated permissions" → search for User.Read → check the box → click "Add permissions".
Click "Grant admin consent for [your organization]" and confirm when prompted. This pre-approves the permission so your members won't see a consent popup on their first sign-in.
You're almost done — just send these items back
Once you've completed the Google Workspace setup above, send the following three items to the WATCHDESK administrator:
.apps.googleusercontent.comyourdomain.orgOnce you've completed the Microsoft 365 setup above, send the following four items to the WATCHDESK administrator:
yourdomain.orgCommon questions about this setup
No. Google OAuth and Azure AD app registrations are both free with all Google Workspace and Microsoft 365 plans, including nonprofit editions. There are no API fees.
Only the member's name and email address. WATCHDESK does not access emails, files, calendars, or any other Google Workspace or Microsoft 365 data.
No. The "Internal" (Google) and "Single tenant" (Microsoft) settings restrict access to members of your organization only.
Azure AD secrets have an expiration date you chose during setup. When it's about to expire, create a new secret in the Azure Portal under your app's Certificates & secrets page and send the new value to the WATCHDESK administrator. Google OAuth secrets do not expire.
Yes. You retain full control. Delete or disable the OAuth credentials in your Google Cloud Console or Azure Portal at any time to immediately prevent sign-in.