IT setup guide

This section is for the IT administrator who configures sign-in, user provisioning, and browser deployment for a Sanitized AI organization. All of these settings are optional: an organization can run on email sign-in links and self-installed extensions alone.

Jump to the task you need

• Choose how people sign in: turn on Google, Microsoft, or Okta sign-in, approve your company domains, and create accounts automatically.
• Configure Okta SSO: create the Okta app, copy the generated URLs, test the connection, and turn it on.
• Configure SCIM provisioning: generate a SCIM token, connect Okta or Microsoft Entra ID, and validate a pilot sync.
• Deploy the managed browser extension: download a policy for Chrome or Edge, force-install the extension, and check a pilot device.

Before you start

Make sure you have:

• A Sanitized AI Admin account.
• Administrator access to your identity provider (Okta, Microsoft Entra ID, or another SCIM-capable provider).
• Administrator access to Google Admin, Microsoft Intune, Jamf, or another device-management platform, if you’ll deploy the managed extension.
• A test user from each company email domain that will sign in.

Recommended rollout order

1. Deploy the managed browser extension to a small pilot group, and confirm that the browser reads every policy as OK.
2. Configure Okta SSO: create the app, test the connection, get each domain approved, then complete a pilot user’s sign-in.
3. Configure SCIM provisioning if your identity provider should create, update, deactivate, or group users automatically. Test a pilot user’s complete lifecycle before you assign everyone.
4. Expand browser and identity provider assignments in stages. After each stage, check the Users and Events pages before you move on.

Tip

Admins whose email is at an approved company domain can always sign in with an email link, even after you require Okta or clear Enable email magic-link sign-in. That gives you a way back in if an identity provider setting goes wrong, as long as an admin can still open their email.

What each integration does

The following table summarizes each integration.

Integration	Purpose
Google and Microsoft sign-in	Let people sign in with their existing work account. No setup in Sanitized AI beyond turning them on.
Okta SSO	Lets people sign in through your organization’s Okta.
SCIM	Lets your identity provider create, update, and deactivate accounts, and sync groups.
Managed browser extension	Lets IT force-install the extension and identify each device.