How do I set up Single Sign-On (SSO) for my organization?

Single Sign-On (SSO) lets your employees sign in to Control Center and the SafetyAware app with the work account they already use, so your own security policies – such as multi-factor authentication and conditional access – apply to SafetyAware too.

Why use SSO?

Convenience: One less password for your workers to remember.
Security: Sign-in follows your organization's own identity and access controls.
Easier onboarding and offboarding: New employees sign in with an account they already have.

Supported identity providers

Microsoft Entra ID (formerly Azure Active Directory) is fully supported. Other OpenID Connect (OIDC) identity providers, including Okta and Google Workspace, are also supported.

Before you start

SSO is turned on for your entire organization, not for individual users.
SSO does not create SafetyAware accounts. Each user must already have a Control Center account with the same email address they use to sign in to your identity provider.
When SSO is on, users can no longer sign in with a SafetyAware password.
One SSO connection covers both Control Center and the SafetyAware app – no separate mobile setup is needed.

What you'll need to provide

SSO is set up by the Aware360 Support or Implementation team on your behalf. Your IT team will need to provide:

The identity provider you want to use
Your Issuer/Tenant URL (for Microsoft Entra ID: https://login.microsoftonline.com/{your-tenant-id})
The Application (Client) ID
A Client Secret created specifically for this connection
A list of employees, by email, who will use SSO

*Note: Never send your Client Secret by regular email or chat.

To set up SSO:

Contact Aware360 Support to request SSO by submitting a ticket
Aware360 will send you a redirect (callback) URL
In your identity provider's admin portal, your IT team creates an application for SafetyAware and registers the redirect URL. Make sure the application includes the user's email address in the sign-in response.
The Aware360 team will create a user account for your IT administrator to login
Have your IT administrator login to Control Center with their user account and add the “Authentication Settings” attribute under the Clients section
Test the connection and hit save
Alternatively, you can securely send the required fields above to Aware360 to enable on your behalf
All existing users or net new users will now have SSO access enabled

Troubleshooting for administrators

Issue	What to check
Suddenly, nobody in your organization can sign in	Check whether anything changed in your identity provider, such as an expired or replaced Client Secret. If so, create a new Client Secret and share it securely with Aware360 Support or update it directly within Control Center with client admin access
One user can't sign in	Confirm the user has a Control Center account and that the email address matches their work account exactly.
A user signs in with Microsoft but still can't get into Control Center	Review the user's role and permissions in Control Center.
An error appears after returning from the company sign-in page	Confirm your identity provider application includes the user's email address in its response.
The app shows a license error	Renew or reassign the user's license or device. This is not an SSO issue.

When submitting a ticket, include the affected user's email, the exact error message, a screenshot if possible, the approximate time, whether it affects one user or everyone, and whether it happens on web, mobile or both. Do not include your Client Secret in the ticket.

Turning off SSO

Turning off SSO applies to everyone in your organization and can't be done for individual users. Before you ask Aware360 to turn it off, make sure your users have working SafetyAware passwords or know how to reset them – they will return to signing in with a username and password.