> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reclaimtime.com/llms.txt
> Use this file to discover all available pages before exploring further.
# First login and SSO
> How the client works out who is at the keyboard, what the sign-on dialog shows when it cannot, and what an administrator needs to fix it.
Nobody types a password into the ReclaimTime client. It works out who is logged in to Windows, asks the backend which ReclaimTime account that is, and signs in as that account. This page covers what it looks up, what it does when the lookup fails, and how to fix the account so it succeeds.
## What the client sends
At startup the client builds one **identifier** from Windows and sends it to the backend.
| Sign-on mode | Identifier | Used when |
| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| **User** | The Windows user principal name (the email-style login, for example `firstname.lastname@example.com`) if Windows provides one. If it does not, the old-style `DOMAIN\username` instead. | The default, and what almost every organisation uses. |
| **Computer** | `domain\hostname` of the machine, not the person. | Shared machines where the account belongs to the computer rather than to a person, such as shop or floor PCs. |
The identifier is lowercased before it is sent. Case in Windows makes no difference.
The user principal name is what `whoami /upn` returns on the machine. It often matches the person's email address, but it does not have to. When a login fails, that difference is usually the reason.
## What the backend matches on
The backend looks for exactly one account where **SSO is enabled** and any one of these matches the identifier:
1. The account's **username**
2. The account's **Windows username** field
3. The account's **email**
If it finds one, the client signs in as that account. If it finds none, the login fails.
**SSO must be ticked on the account.** An account that matches perfectly on every field but has SSO switched off is not returned, and the client reports the user as not provisioned. This is the single most common cause of a client that never appears in the dashboard.
## What the employee sees
In the default locked configuration there is no login window. A single status dialog appears, titled **ReclaimTime** and the installed version number, and closes itself five seconds after a successful sign-in.
**While it is trying:**
> **Single Sign-On Pending**
>
> Username: `DOMAIN\username`
> Email: `firstname.lastname@example.com`
>
> Attempting to connect...
**When it works:**
Once it has closed, a locked client has no window at all. Opening ReclaimTime again from the Start menu does not show an interface, it just brings this dialog back, which is how somebody checks whether the client is signed in.
**When it does not:**
> **Single Sign-On Failed!**
>
> Reason: `the error`
> Windows Username: `DOMAIN\username`
> Windows Email: `firstname.lastname@example.com`
>
> Please provide the above details to your **System Administrator** for assistance.
The two lines the administrator needs are **Windows Username** and **Windows Email**. The email line only appears when Windows supplies a user principal name. A screenshot of this dialog is all a helpdesk ticket needs to contain.
## What the messages mean
| Reason shown | What it means | Fix |
| ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| **SSO Failed: User not provisioned.** | Nothing matched, or the matching account does not have SSO enabled. | Create the account, or correct its email, username or Windows username, and tick SSO. |
| **This account is not associated with an Organization. Please contact your administrator.** | The account was found, but it has no organisation set, so the client has nowhere to report. | Set the organisation on the account. This has happened when a super admin created users without picking an organisation from the dropdown. |
There is a third message that is not a sign-on failure at all. The account signed in correctly, but the organisation it belongs to has no licence:
Nothing about the account will fix this one. Contact us to have the licence put on the organisation.
## The client keeps trying
The client does not give up after a failed sign-in, and the employee does not need to do anything once the account is fixed.
| Situation | What the client does |
| ---------------------------------------- | ------------------------------------------------------------------------------------- |
| Account not found, or found but rejected | Retries the whole lookup every **5 minutes** |
| No network | Retries every **60 seconds** until the network comes back |
| Signed in | Stays signed in. Activity is cached locally and uploaded when the connection returns. |
So the sequence for a helpdesk is: create or correct the account, then wait. Within five minutes the client signs in on its own and the person appears in the dashboard. There is no need to restart the client or the machine, and no need to reinstall.
A person who has just been created will not show activity immediately even after a successful sign-in. The client uploads a session for the first time after about a minute of visible time, and the dashboard hides rows younger than 15 minutes, so allow up to 20 minutes before treating a new user as broken.
## Checklist for a user who never appears
1. Ask for a screenshot of the sign-on dialog. It gives you the exact Windows username and email the machine is sending.
2. Find the account in **Workforce**. If there is none, create it. See [Accounts](/admin/accounts).
3. Check that **SSO** is ticked.
4. Check that the account's email, or its Windows username field, matches what the dialog showed.
5. Check that the account has an organisation and a role of Standard.
6. Wait five minutes, then look at the **Versions** page. The person moves off **Never seen** as soon as the client signs in.
## Related tasks
* [Add a new starter](/guides/add-a-new-starter)
* [Troubleshooting](/guides/troubleshooting)
***
*Checked against ReclaimTime client 8.0.0.9 and dashboard V3 on 5 September 2026.*