Getting your people in, your way

What’s the same every way

Whichever way you choose, the same rules keep your people and your seats safe.

• One seat each. Every person uses one seat from the moment they’re added, and removing them frees it straight away. A change that needs more seats than you have free is refused before anything changes, whether it’s one person or a whole file.
• Everyone verifies first. Before anyone can sign in, they confirm their account: with an emailed link that lasts 14 days, or with their first sign-in through single sign-on. You can see who is still waiting and send them a new link.
• No passwords. People sign in with a one-time code sent to their verified email address, or with their work account. Admins, managers, course authors and externals also use an authenticator app or a passkey.
• Roles are yours to give. The manager and course author roles come from your files, the API or the screen, never from single sign-on or your directory. The site admin role is only ever given on screen, by another admin.
• Nothing happens twice. Staff are matched by their company ID, so adding the same people again changes nothing.
• Everything is recorded. Every change is in the audit log, with who made it, when, and whether it came from the screen, a file, the API or your directory.

Spreadsheet files

There are three files. Each one downloads with what is in your site now, so the download is also the template: edit it in any spreadsheet and upload it again.

Every upload, step by step

1. Download the file from the Files page, or use your HR system’s own export.
2. Fill in a row for each person. Groups that don’t exist yet are made for you, so one People file can set up a whole site.
3. Upload it. You see a preview first, such as 120 new, 14 updated and 2 errors, with 134 seats needed and 150 free. Each error says what’s wrong, and you can download them.
4. Tick the new groups and the role changes. Each list has its own tick, so a typo can’t quietly make a group and a role change can’t hide in a big file.
5. Choose when the verification emails go: as soon as it’s applied, or on a launch day up to 90 days ahead.
6. Press Apply. The upload history keeps a result for every row, which you can download.

Good to know

• Columns you leave out are left alone, so a file with only id and is course author changes nothing but course authors.
• Files are CSV or tab-separated, up to 50,000 rows and 20 MB. Downloads open correctly in Excel.
• Dates are year-month-day, such as 2026-10-26, and your spreadsheet’s own style, such as 26/10/2026, works too.
• Your own export. If your HR system’s columns have other names, you match them to ours once, and TrioLMS remembers it for the next file with the same columns.
• Managers can upload a People file for their own groups, within each group’s seat cap.

Full sync

Full sync keeps your list exactly in step with the file. It adds and updates as usual, and also moves anyone who isn’t in your People file to the bin. The preview lists who would move, it needs its own tick and your authenticator code, and you can undo it for 7 days. It never moves a site admin, you, or an external.

Single sign-on and directory sync

With the single sign-on add-on, your people sign in with the work account they already use, and directory sync keeps your people in step with your company directory. We use WorkOS, a specialist in company sign-in, so your IT team sets up its side on WorkOS’s guided pages, without waiting for us.

What it works with

• Microsoft Entra ID (formerly Azure AD)
• Google Workspace
• Okta
• Any other SAML or OpenID Connect provider, for sign-in
• Any SCIM directory, for directory sync

Setting it up

1. Your TrioLMS administrator adds the single sign-on add-on on Plan and billing, for the sites that need it.
2. In the site’s Settings, open Single sign-on and press Connect SSO. A set-up page opens with step-by-step instructions for your provider.
3. Press Verify a domain and prove you own your email domain the same way, so only your company’s addresses can sign in like this.
4. If you’d like people to follow your directory, press Connect a directory and connect it the same way.
5. Link your directory groups to groups in TrioLMS, if you’d like who is in a group to follow the directory too.
6. Download the People file, mark your managers and course authors, and upload it again. Roles always stay yours.

How it works

• A person’s first sign-in links to the account you added, only through your own connection and only for your verified domains. After that the account is tied to their work account, and never matched by email again.
• With directory sync, people are added when they join your directory and moved to the bin when they leave, so your seats follow the directory. Their names and email addresses come from it too.
• Every message from WorkOS is signed and checked, and we always read the latest from WorkOS before acting on one, so a late or repeated message can’t change anything wrongly. An hourly check puts right anything missed.
• Sign-in uses the OAuth 2.0 authorisation code flow with PKCE, and TrioLMS never reads SAML itself.
• Without directory sync, add people by file, the API or on screen, with sign in set to sso. You can also let people join at their first sign-in, within the email domains and seat limit you set. That is off unless you turn it on.

API and webhooks

The API lets your own systems, such as an HR system, do what the files do, with the same rules. It is for companies with a developer: you don’t need it to use TrioLMS.

Keys

• A site admin makes a key on Settings, API, with a name, its permissions (people, groups, roles, read reports) and an expiry date up to 12 months ahead.
• The key is shown once. We keep only a keyed hash of it, so nobody can show it again, and it works only at its own site.
• No key can ever make a site admin or change the site’s settings.

What it does

• Reads your people, groups and externals, 500 at a time.
• Adds and updates up to 1,000 people, groups or externals in one call. Each call is checked and applied exactly as a file is, and you can check one first without changing anything.
• Moves people to the bin, but never a site admin.
• Reads every report as a site admin sees it on screen.

It is JSON over HTTPS at your site’s own address, under /api/v1/, with the key as a bearer token. Each key can make up to 300 requests a minute, and every call shows on the Files page as an upload by that key.

Webhooks

Webhooks tell your systems when someone is added, verifies their account or completes a course. They follow the Standard Webhooks specification, so any of its libraries can check them, and each one is signed with HMAC-SHA256. They name the person only by their account ID, so nothing personal leaves your site. A webhook that can’t be delivered is tried again, up to 10 tries in all over about two days.

Your developer can have the full API reference before you buy. Ask us for it

The built-in LRS

Every site has its own learning record store for xAPI, built to xAPI 2.0 (IEEE 9274.1.1-2023) and 1.0.3, and tested against ADL’s LRS conformance test suite. The cmi5 launcher is tested against the cmi5 test suite.

• It is at your site’s address, under /xapi/.
• Reporting tools connect with LRS credentials a site admin makes on Settings, API: send and read, or read only, each with an expiry date.
• Courses get short-lived credentials that only work for one learner and one registration.
• Learners are named by an account ID, never by their email address or name.
• You can forward every new statement to an outside LRS, such as Learning Locker or Watershed. It is off until a site admin turns it on.

Where your data lives

• Each site and all of its records stay in the region you choose for it: UK and EU, or US.
• We keep only what we need about a person: their company ID, email address and name, their language, and an organisation and notes for externals. Never a password, photo, phone number or birthdate.
• Course files are served from a separate domain that never sees a sign-in cookie, so a course’s own code can’t reach anyone’s account.

Your first day, step by step

Pick the list that fits you. Either way, you can stop at any step and come back later.

With spreadsheet files

1. Sign in to your site and open Files.
2. Download the People file. It is your template.
3. Add a row for each person: their ID, email address and name, the groups they learn in, and yes under is manager or is course author where it fits.
4. Upload it, check the preview, tick the new groups and roles, and choose when the emails go.
5. Add anyone from outside your company with the Externals file.
6. Follow the verification count on Home until everyone is in. Later changes work the same way: download, edit, upload.

With single sign-on and directory sync

1. Connect single sign-on and your directory, as above.
2. Link your directory groups to groups here, and let the first sync add everyone.
3. Download the People file, mark your managers, the groups they manage and your course authors, and upload it again.
4. Add externals with the Externals file, and follow the verification count on Home until everyone is in.