How to set up Single Sign-On (SSO)
Note: SSO is a paid add-on. If you're interested in enabling it, contact your Vatix account manager.
Single Sign-On (SSO) lets your users log in to Vatix using your existing identity provider (Microsoft Entra or Okta), without needing a separate Vatix password. This article covers the configuration on your side; once you've completed the steps, share the required credentials with Vatix and we'll enable SSO on your account.
Note: If your organisation has a mix of SSO and non-SSO users (some logging in via your identity provider, some using email and password), let Vatix know during setup so we can configure the login screen correctly.
How to set up SSO with Microsoft Entra
Register a new application in the Microsoft Entra admin centre, following Microsoft's app registration guide. When configuring the application, use these values:
| Setting | Value |
|---|---|
| Redirect URI (type: Web) | https://auth.vatix.com/oauth2/callback |
| Logout redirect URI | https://workspace.vatix.com/login/ |
| Supported account types | Single tenant only |
The logout redirect URI is added separately after the initial registration: go to 'Manage' > 'Authentication' and add it there.
Then create a client secret for your application. Copy the secret value immediately, as it is only shown once.
Configure consents
You'll need to set up application consents in Microsoft Entra. Microsoft has detailed guides:
- Configure the admin consent workflow
- Grant tenant-wide admin consent
- Configure how users consent to applications
Share the values with Vatix
Securely send Vatix the following:
- Application (client) ID
- Directory (tenant) ID
- Client Secret (Value)
How to set up SSO with Okta
Create a new OIDC web application integration in your Okta admin panel, following Okta's app integration guide. When configuring the integration, use these values:
| Setting | Value |
|---|---|
| App type | OIDC - OpenID Connect / Web Application |
| Sign-in redirect URI | https://auth.vatix.com/oauth2/callback |
| Grant type | Authorization Code |
Under 'Assignments', select 'Skip group assignment for now' and save.
Capture credentials
- From the integration overview, copy the 'Client ID' and 'Secret'.
- Under 'Sign On', go to 'OpenID Connect ID Token' and note the Okta URL (Issuer).
- Copy the Okta URL.
Assign users
- Go to 'Directory' > 'People'.
- Click on the user you want to authenticate.
- Click 'Assign Applications', then 'Assign' next to your new application.
- Click 'Save and Go Back', then 'Done'.
Share the values with Vatix
Securely send Vatix the following:
- Client ID
- Secret
- Okta URL
Multi-tenancy SSO
If your organisation has multiple regional entities or subsidiaries, each with their own identity provider, you'll need to provide a separate set of credentials for each one.
Follow the same setup steps above for each entity, then share all sets of credentials with Vatix. We'll create a separate identity provider connection for each one and link them to your account.
Note: If each entity has its own identity provider administrator, collect the credentials from each of them separately before contacting Vatix.
What happens next
- Vatix reviews your details and proposes a release date.
- You confirm the proposed date.
- Vatix enables SSO on the confirmed date.
Once enabled, your users can log in via your identity provider on their next login.
Note: If you encounter issues during setup, contact support@vatix.com or ask to be connected to a live agent in the chat window.