Security Configuration

A common challenge organizations face is ensuring the security of apps containing sensitive information accessed by employees. Minimizing potential account breaches and reducing the overall attack surface is essential. To address the security concerns, Josys supports the linking of Single Sign-On (SSO) with Google Workspace, Microsoft 365 (Azure AD), and Okta through the Josys Settings>>External Data Sources. 

Once linked, the IT Admin gains visibility into the user accounts with SSO and Multi-Factor Authentication (MFA) enabled for business-critical applications. Currently, Josys provides users account visibility for Google Workspace, Microsoft 365 (Azure AD), Okta, and Salesforce apps. Additionally, the IT Admin can identify highly privileged accounts lacking essential security configurations, such as MFA, and take necessary actions such as enforcing MFA or contacting employees to address the security gaps and ensure compliance.

Steps to Link SSO

Step 1: Log in to Josys using your admin credentials.

Step 2: Navigate to the Settings menu and select External Data Sources.

Step 3: Locate the Single Sign-On (SSO) section and click the Link/Integrate option of the respective app. Let's take an example of Google Workspace. (Learn more about the integration steps of Google Workspace and Microsoft 365 (Azure AD).)

The status of the SSO is changed to Linked.

Note: Please allow some time for the system to retrieve the security configuration data from the external data source app.

After linking SSO, you can view the user account details to check their SSO and MFA statuses.

Steps to Access Security Configuration

Step 1: Navigate to the Apps menu and select Security Configuration.

The following screen is displayed when no SSO app is linked with Josys. You can perform any of the following actions on this screen:

• Integrate SSO Apps by clicking Integrate SSO Apps.
• Access learning materials by clicking Learn More.
• If the SSO App is not available in Josys, click Share Details to share details of your SSO Apps.

After linking the SSO app, all user accounts from the app are synchronized in Josys and the apps display the following statuses on the widgets:

• SSO Provider: Identifies the SSO provider used by the organization, allowing users to authenticate via this app and then log in to other connected applications (such apps are marked with "SSO Enabled" status).
• SSO Enabled: The user can directly access the app after authenticating through the SSO provider.
• SSO Not Enabled: SSO login is not configured for the app, and users must log in using their credentials.

The App widgets display the following information:

• SSO: Displays the count of user accounts that have either enabled or not enabled SSO for the app. For example, in the following image, 64 users have enabled the SSO in Google Workspace, while 32 have not.
• MFA: Displays the count of user accounts that have either enabled or not enabled MFA for the Google Workspace account. In the following image, 79 users (out of which 64 SSO Enabled users and 15 SSO Not Enabled users) have enabled MFA in their Google Workspace accounts. The 17 count displays the number of users who have not enabled the MFA for their Google Workspace accounts.
  
• The number 7 indicates the accounts with privileged access that have neither enabled the SSO nor MFA.

Step 2: Clicking on these counts takes you to their respective user's account under Managed Apps. The App displays the Authentication Method and MFA Status for each of the user's accounts. After knowing the current security configuration of the app, the IT Admin can take necessary actions.

The tooltip in the apps provides detailed information about the count of user accounts with and without SSO enabled, giving a clear overview of the authentication status for each user. 

Steps to Unlink SSO

Step 1: Locate the Single Sign-On (SSO) section from the Settings>>External Data Sources.

Step 2: Click and select the Unlink option from the app.

The app will be unlinked from Josys.

Steps to Take When Organization is Not Using Single Sign-On (SSO) Authentication Method

If an organization is not using SSO or is using a different SSO provider than the one supported by Josys, then they can share the respective details.

Step 1: Locate the Single Sign-On (SSO) section from the Settings>>External Data Sources.

Step 2: Click Share Details.

Step 3: If no SSO is used, then select the first option "We don't use SSO" or for a different SSO, select the second option "SSO is not available in app catalog" and enter the SSO App name.

Step 4: Click Submit.