Sign in with Okta single sign-on (SSO)

Overview

Single sign-on (SSO) lets your staff sign in to BloomText with the same Okta account they use for their other work apps. Your IT team decides in Okta who gets BloomText, and BloomText gives them access before they first sign in. When someone leaves and IT turns off their Okta account, BloomText removes them from every organization in your account, as long as their BloomText email matches Okta.

SSO is set up once for your whole account. Your account is your company in BloomText: its plan and billing, and every organization (each clinic or office) under it. All of your organizations sign in through the same Okta connection.

SSO is for companies whose staff already sign in through Okta. Okta comes first. Microsoft Entra ID, Google Workspace and other SAML or SCIM directories work through the same setup .

Nothing changes for an account until it turns SSO on. Patients are not affected: they keep signing in to BloomText the way they do today.

How to get SSO

1. Contact BloomText. SSO is a paid add-on; contact us to add it, or email support@bloomtext.com. BloomText turns it on for your account.
2. Your IT team connects Okta. An account Owner or someone with the account's IT role opens Settings > Account > Okta & rules and connects Okta and your Okta directory. See Set up single sign-on for your account.
3. IT decides who goes where. Rules map Okta groups or attributes to your organizations, roles and teams. See the Okta setup guide for IT.
4. Staff sign in with SSO. People IT assigns in Okta already have access, and use Sign in with SSO.

Sign in with SSO

On the web or desktop app

1. On the sign-in screen, click Sign in with SSO.
2. Type your work email under Work email.
3. Click Continue.
4. Sign in on your company's Okta page. On the desktop app, the Okta page opens inside the BloomText window.
5. BloomText opens your inbox.

On iPhone or Android

1. On the Sign in screen, choose Provider.
2. Tap Sign in with SSO.
3. Type your work email and tap Continue.
4. Sign in on your company's Okta page, which opens in a sign-in window over the app.
5. BloomText opens your inbox.

If the app says Update BloomText to sign in with SSO., update the app from the App Store or Google Play, then try again.

Your first day

When IT assigns you to BloomText in Okta, BloomText sets up your access within 5 minutes: the organizations, role and teams your company's rules give you. You don't need an invite or an admin's approval. Sign in with SSO and your organizations are there.

If Okta won't let you in to BloomText, your IT team hasn't assigned you to it in Okta yet. Ask them.

If you sign in before your access is set up

If Okta lets you in but your company's rules haven't given you an organization yet, your sign-in becomes a request to join your account's default organization. BloomText says Your request to join the organization is pending. An admin of that organization approves it.

If an admin declines it, signing in with SSO again says Your request to join the organization was declined. Ask your admin to invite you.

If you were invited by email, you can accept the invite by signing in with SSO.

What changes for staff

• No texted code after Okta. Your company's Okta sign-in handles the extra check, so BloomText doesn't text you a code when you sign in with SSO. If you also belong to another company's organization that requires two-factor login, BloomText still asks for the texted code.
• Quick-login PINs are off. Members of an account that uses SSO can't set up or use a quick-login PIN. The Quick Login section no longer shows in Settings > Security. A PIN set up earlier stops working, and BloomText asks you to sign in with SSO instead.
• Your password may still work. Until your account requires SSO, you can sign in with your password or with SSO. Once your Owner or IT turns on Require SSO, staff whose email is on your company's domain must use SSO.
• Okta can set your access. Your organizations, your role in each (Admin or User) and your teams can come from Okta. On an organization's Members tab those memberships show an Okta badge and 🔒 Managed by Okta. To change them, ask your IT team. An organization admin can still add you to more teams. See Work with people Okta manages.

Messages you might see

Edge cases / gotchas

• SSO covers the whole account. Every organization in your account signs in through the same Okta. Organizations in another company's account keep their own sign-in rules.
• Leaving in Okta removes you from the whole account. When IT deactivates or deletes someone in Okta, BloomText removes them from every organization in the account and signs them out on every device within 5 minutes. This works when their BloomText email matches Okta; see What the directory does.
• Use your work email. Type the email you use in Okta. BloomText uses its domain to find your company's sign-in.

Related flows

• Set up single sign-on for your account
• Okta setup guide for IT
• Work with people Okta manages
• Log in fast with a quick-login PIN
• Turn on two-factor login
• Security and HIPAA compliance