Signing in & roles¶
Signing in¶
- Open oncall.totlcom.com in any web browser (Chrome, Edge, Safari, or Firefox).
- You'll be sent to the Microsoft 365 sign-in page — the same login you use for your TOTLCOM email.
- Enter your work email and password and approve any multi-factor prompt (the Microsoft Authenticator app or a text code).
- Once signed in, you land on the Schedule screen.
You stay signed in for a while, so you usually won't have to log in every time.
Why the Microsoft login?
The whole app sits behind Cloudflare Access, which checks your Microsoft 365 identity before the app even loads. This means only TOTLCOM staff can reach it — there is no separate password to remember.
Can't get in?
If Microsoft says you're not allowed, your account may not be on the access list yet. Contact whoever administers the app (the person who set it up) and ask them to add your email. See the Admin page and the deployment guide's Microsoft 365 SSO page for how that list works.
The three roles¶
After you're signed in, what you can do depends on your role:
| Role | Can view | Can edit schedule, roster, time off, holidays | Can manage users |
|---|---|---|---|
| Viewer | ✅ | ❌ | ❌ |
| Editor | ✅ | ✅ | ❌ |
| Admin | ✅ | ✅ | ✅ |
- Viewer is the default. You can look at everything and use Export, Print, and Download backup, but all the buttons that change data are hidden.
- Editor can change schedules, the roster, time off, and holidays.
- Admin can do everything an editor can, plus manage the list of editors and admins on the Admin tab.
How your role is decided
A starter list of admins is built into the app's settings (the ADMIN_EMAILS setting). Everyone else starts as a viewer and can be promoted to editor or admin by an admin on the Admin tab. If you think you should have more access, ask an admin.
Finding out your own role¶
You don't need to guess. If the edit buttons (like Add, Edit, Generate) are missing, you're a viewer. If you can see the Admin tab, you're an admin.