Set up single sign-on for your account

Single sign-on (SSO) is set up once for your whole BloomText account, and every organization in the account signs in through it. BloomText turns on SSO for your account. Then an account Owner or someone with the account's IT role connects Okta and your Okta directory, and can require staff to sign in with SSO. For what SSO is and how staff sign in, see Sign in with Okta single sign-on (SSO). For groups, rules and what the directory does, see the Okta setup guide for IT.

Okta comes first. Microsoft Entra ID, Google Workspace and other SAML or SCIM directories work through the same setup .

Before you start

• You need to be an account Owner or have the account's IT role. Organization Admins don't see the Okta & rules tab.
• BloomText needs to turn on SSO for your account first. SSO is a paid add-on for the account, whatever its number of organizations or people; contact us to add it, or email support@bloomtext.com. The Okta & rules tab appears once it's on.
• Have someone with admin access to your Okta account with you.
• In Okta, require MFA in the BloomText app's sign-on policy. BloomText doesn't text a code to people who sign in with SSO.
• Use the web app or the desktop app. SSO setup isn't on the mobile app.

Connect Okta

1. Click Settings, the gear at the bottom of the left bar.
2. Click Account.
3. Click the Okta & rules tab. Under Single sign-on it shows Identity provider, Directory and Verified domains, and a line saying what's next.
4. Click Set up in WorkOS. WorkOS, BloomText's sign-in partner, opens a setup portal in the same window, at the next step:
   1. Verify your domain. Prove you own your email domain, such as @yourcompany.com. Only people with an email on a verified domain can sign in with SSO. An email domain belongs to one BloomText account.
   2. Connect Okta. Add BloomText as a SAML app in Okta. WorkOS's Okta SAML guide shows each Okta screen.
   3. Connect your Okta directory. Add the SCIM app in Okta so your directory syncs. This step is required. WorkOS's Okta SCIM guide shows each Okta screen.
5. When a step is done, the portal brings you back to Okta & rules. Click Set up in WorkOS again for the next step.
6. When all three are done, the banner at the top says Okta connected · directory syncing.

The line under Single sign-on tells you where you are:

Until setup is finished, staff who try Sign in with SSO see SSO isn't set up for this email. Sign in with your password.

If the portal says its link has expired, go back to BloomText and click Set up in WorkOS again.

Next, write the rules that decide which organization, role and teams each person gets. See Write rules.

If the directory disconnects

If Okta stops syncing, Okta & rules shows Directory disconnected: people removed in Okta won't be removed from BloomText until it's reconnected. Click Set up in WorkOS to reconnect it. Until then, remove anyone who leaves by hand.

Require SSO

Requiring SSO makes everyone with an email on your verified domains sign in through Okta, in every organization in the account.

1. Sign in to BloomText with Sign in with SSO.
2. Open Settings > Account > Settings.
3. Under Sign-in security, turn on Require SSO for your domains.
4. The window Turn on Require SSO? says who will be signed out. Click Turn on.
5. A bar at the top confirms Require SSO is on.

The switch saves on its own; there's no Save to click. It's off and can't be changed when:

• Available once Okta and its directory are connected. Finish Connect Okta first.
• To change this, sign in to BloomText with SSO. You signed in with a password. Sign out and use Sign in with SSO.

With Require SSO on, for anyone with a confirmed email on your verified domains, including an extra email added to their profile:

• Password and PIN sign-in are refused, in every organization. Resetting a password, and setting or changing one, are refused too. BloomText sends them to Sign in with SSO.
• Their password and PIN sessions end right away, on every device. Their next screen says Your organization now signs in with SSO. Sign in again with SSO.
• Sessions that signed in with SSO, yours included, carry on.

Members whose emails are all off your domains keep signing in with their password. Turn the switch off to allow password sign-in again.

Invites outside Okta

Organization Admins can invite people Okta doesn't manage, such as contractors, unless you turn that off. The switch is on by default, and shows under Sign-in security once SSO is on.

1. Open Settings > Account > Settings.
2. Turn off Allow Admins to invite people outside Okta.
3. In Stop Admins inviting people outside Okta?, click Turn off.
4. A bar confirms Admins can add only people Okta manages.

The switch saves on its own. With it off:

• Organization Admins can invite only people Okta manages. When they try to invite someone else, BloomText tells them Your account only lets Owners and IT add people who aren't in Okta. Ask them to add this person.
• Owners, IT and the account's API keys can still invite anyone.
• Nobody already in your organizations is removed.

People who join through SSO

• Someone without access yet. A person Okta lets in who isn't yet a member of any organization in your account becomes a pending join request to the account's default organization. On that organization's Members tab it's labeled via SSO. An Admin approves or declines it. See Approve join requests and find members.
• A declined request stays declined. If they sign in with SSO again, BloomText tells them Your request to join the organization was declined. Ask your admin to invite you.
• Invited people. Someone with a pending invite can accept it by signing in with SSO.

Usually your rules give people access before they first sign in, so join requests are for people no rule has placed yet.

Removing people from Okta

When IT suspends, deactivates or deletes someone in Okta, BloomText removes all their memberships and any Owner or IT role in your account, and signs them out, within 5 minutes. Their BloomText user stays. This works for people BloomText matched to their Okta email. For the details, including the only-Owner case and members it can't match, see What the directory does.

Good to know

• Quick-login PINs are off for every member of an account that uses SSO, and SSO sign-ins don't ask for a texted code: your company's Okta sign-in handles the extra check. A member who also belongs to another company's organization that requires two-factor login still gets the code. See What changes for staff.
• Rules can make someone an organization Admin or User. The account's Owner and IT roles are set only on the Account page, never from Okta.
• Patients are not affected by SSO.
• To turn SSO off for your account, contact support@bloomtext.com.

Related

• Sign in with Okta single sign-on (SSO)
• Okta setup guide for IT
• Work with people Okta manages
• Invite teammates and choose their role
• Approve join requests and find members