SSO Configuration for Okta Customers

In order to proceed with configuring login with SSO through Okta, you must:

• Have access to an Okta tenant
• Be an Okta administrator to that tenant
• Have an active Safety AZ subscription for your organization

• Service Provider (SP)-Initiated Authentication (SSO) Flow - This authentication flow occurs when the user attempts to log in to the application from Safety AZ.

Send an email to salut@safety-az.com with the email address you want to use for the Express Configuration admin account.

Safety AZ support will create an admin account and reply with:

• A temporary password
• An organization name unique to your company

1. In Okta, go to Applications → Browse App Catalog
2. Search for Safety AZ and click Add Integration
3. Click Done

1. On the newly created Safety AZ application, click the Sign On tab
2. Click Express Configure SSO
3. Enter the organization name provided by Safety AZ
4. When prompted for credentials, enter the admin email and temporary password provided by Safety AZ
5. On the next screen, approve the connection with Safety AZ to complete the setup

Send an email to salut@safety-az.com to confirm that you have completed the Express Configuration setup.

Safety AZ support will then:

• Enable home realm discovery for your domain
• Enable application access so your users can log in

Wait for confirmation from Safety AZ before proceeding to the next step.

Once Safety AZ has confirmed the setup is complete:

1. Assign the admin account to the Safety AZ application in Okta
2. Assign any other users or groups that should have access to Safety AZ
3. Test the login flow: on safety-az.com, open Sign In, choose your Safety AZ platform and sign in with the admin account
4. You should be automatically redirected to your Okta SSO login

After successfully testing the login flow, send a final email to salut@safety-az.com to confirm everything is working.

Safety AZ will then remove the temporary admin account as it is no longer needed.

The sign-in process is initiated from Safety AZ.

1. From your browser, navigate to safety-az.com
2. Open Sign In and choose your Safety AZ platform, or go straight to your platform's own address
3. Enter your enterprise email address
4. You will be automatically prompted to authenticate with Okta
5. Enter your Okta credentials (email and password) and sign in
6. If your credentials are valid, you are redirected to that platform in Safety AZ.

Safety AZ does not support Okta Universal Logout yet. A Safety AZ session that is already open stays open when:

• An administrator initiates a logout from the Okta Admin Console
• The Okta system detects risk and terminates sessions for security

To stop someone signing in again, unassign or deactivate them in Okta. Signing out of Safety AZ does not sign the user out of Okta.

Okta decides who can authenticate; Safety AZ decides what each person can open. Safety AZ does not create accounts from Okta, and there are no seat or license checks at sign-in.

How it works:

• On Management AZ and the provider platforms (Occupational Health & Safety AZ, Occupational Medicine AZ, Occupational Psychology AZ), someone who signs in without a Safety AZ account is taken to first-run setup, which creates a new organization with them as its administrator
• On Employee AZ, National Authorities AZ and Local Authorities AZ, access needs an invitation — without one, sign-in does not open the platform
• Colleagues who should join your existing organization need an invitation from it; if they sign up on their own, they create a separate organization

Attributes read from Okta:

• Email address
• Full name

• Safety AZ only allows SSO-based login and does not support password-based login for enterprise accounts
• Please ensure that all users who need access to Safety AZ can authenticate using Okta
• Users are not provisioned from Okta automatically — invite colleagues from your Safety AZ organization

If you encounter any issues during configuration or login, please contact Safety AZ support at salut@safety-az.com.