Purpose of this Document

This jacket document explains the authentication and authorization approaches created for the MayaMaya Enterprise Pilot. The goal is to enable a quick and low-friction pilot while also supporting enterprise-grade Single Sign-On (SSO) for organizations that require it.
The pilot has been intentionally designed with privacy-first principles, ensuring minimal data access and no collection of sensitive personal or corporate information.

Overview of Authentication Options

To get the pilot started efficiently across different enterprise environments, two authentication options have been created:

1. Option 1: Standard Email-Based Signup (Least Resistance)
2. Option 2: Microsoft Entra ID–Based SSO (Enterprise SSO)

Organizations can choose either option based on their internal security and IT requirements.

Option 1: Google Signup with Personal Email ID (Least Resistance)

This option is designed to minimize onboarding friction and enable rapid pilot participation.

How It Works

• Users sign up using their personal email ID via Google Sign-In.
• Authentication is handled through Google’s secure OAuth-based login flow.
• No corporate identity system or IT admin involvement is required.

Data Access & Privacy

• Through Google Sign-In, the system only captures:
  • User name
  • Email ID
• No passwords are stored by MayaMaya.
• No additional personal, device, or organizational data is collected.
• No access is requested to:
  • Email content
  • Files, calendars, contacts, or messages

When to Use This Option

• For the fastest possible pilot onboarding
• When users are participating individually using personal email IDs
• When enterprise SSO is not mandatory
• For early validation with minimal IT dependency

Option 2: Microsoft Entra ID–Based SSO (Corporate Email)

This option is designed for enterprises that require centralized identity management and SSO using their corporate credentials.

How It Works

• Users authenticate using their corporate email ID via Microsoft Entra ID.
• SSO is enabled once the organization grants admin consent for the MayaMaya application.

Permissions Requested (Least Privilege)

The application requests only the following standard permissions:

• openid – OpenID Connect authentication
• profile – Basic user profile information
• email – User email address
• User.Read – Read signed-in user profile

Data Access & Privacy

• The application can access only:
  • User display name
  • User email address
  • User’s unique Microsoft Entra ID (identifier)
• The application cannot access:
  • Mailbox, Teams, OneDrive, SharePoint, or Calendar data
  • Directory-wide or tenant-wide information
  • Background, offline, or write access

This ensures strict adherence to enterprise security and privacy expectations.

When to Use This Option

• When enterprise SSO is required
• When IT governance mandates Entra ID–based authentication
• For pilots involving corporate identity policies

Common Principles Across Both Options

Regardless of the authentication method chosen:

• Only name and email ID are collected
• No sensitive personal or corporate data is accessed or stored
• No access to organizational systems, files, or communications
• Authentication is used solely for identity verification and access control