One more password to lose
A separate Buzz credential is a separate thing to forget, reset and write on a sticky note. It is also a credential your IT team cannot see, cannot age out and cannot bring under the policy it already runs everywhere else.
The problem
Every account has to belong to one named person. That is the expensive part.
Shared logins are not an option in healthcare. HIPAA requires unique user identification, so every clinician, coordinator and administrator needs their own account in every system. Multiply that by the number of systems and the cost is not the license, it is the sign-ins, the password resets and the accounts nobody closes when someone leaves.
Policy that stops at the door
Your organization already decides who needs a second factor, which devices are trusted and which sign-ins to challenge. A system with its own private login is a system where none of that applies.
The account nobody closed
Joining is the half everyone plans for. Leaving is the half that gets missed, and it is the half an auditor asks about.
How the sign-in works
Four steps, and your password never leaves your own login page.
BuzzPassport uses SAML. The exchange is between two parties, and the one holding your passwords is not Buzz.
1 · Redirect
Buzz hands you off
A user opens the Buzz login page and is redirected straight to the organization's own identity provider. Nothing is typed into Buzz.
2 · Authenticate
On your page, not ours
The user enters their credentials on the organization's login page, the same one they use for everything else, under the same rules.
3 · SAML token
The identity provider vouches
Your identity provider issues a signed assertion: this person is who they say they are. That assertion is what travels to Buzz, and it is not a password.
4 · Validate
Signed in, already
Buzz validates the assertion and the user is in. No second credential, no second password policy, no second thing to reset at 7 a.m. on a Monday.
Buzz is the service provider
It is the thing being signed in to. It asks your directory a question and
accepts a signed answer. It is not the place anyone's password is checked.
Your directory is the identity provider
It is the thing that knows who people are, decides whether a sign-in is
allowed, and signs the assertion that says so.
Credentials stay with you
They are entered only on your organization's login page. Buzz never stores them and never sees them.
The directories you already run
Microsoft Entra ID, the directory formerly called Azure AD, along with Okta and Ping.
Your policies still run
Multi-factor and conditional access are enforced by your identity provider, so whatever your organization already requires continues to apply.
Just-in-time provisioning
A new user can be provisioned at their first successful sign-in rather than created in advance.
Illustration
The same morning, twice.
Step through a referral arriving, once with three separate sign-ins and once with a single organizational identity. The rest is an illustration of what single sign-on changes, not a documented workflow.
Three separate sign-insEach system holds its own account
Sign in to BuzzAccount, password, passphrase
Open the referral channelThe care team is already there
Sign in to OutlookA second credential, separately managed
Find the referral in the mailboxCopy the details across by hand
Sign in again for the automationA third credential, often shared, which it must not be
Run the workflow stepThe referral finally reaches the team
Sign-ins so far: 3
One identitySingle sign-on through your identity provider
Sign in once, on your own login pageBuzz redirects; the password is entered at your identity provider
Buzz validates the assertion and opensSame person, same account, no second credential
Outlook is already connectedThe referral is in the mailbox, with no second sign-in
The Power Automate step runsThe referral reaches the team, with no third sign-in
Sign-ins so far: 1
Illustration. The counts are of sign-ins in this illustration, not a measured result at any agency.
The other two connections
Outlook, Power Automate, and the workflow they were built for.
Outlook
BuzzPassport connects Buzz to Outlook, the mailbox where a referral arrives, so your team works from the same organizational identity in both places.
Power Automate
BuzzPassport connects Buzz to Power Automate, so a referral can move on to the next workflow step without another sign-in.
Andwell's referral workflow
BuzzPassport was built for Andwell's referral workflow. It joins the referral arriving in Outlook to the Power Automate step that carries it to the care team, under one sign-in.
Governance
Who can act, who can see, and who takes over.
Single sign-on decides how people get in. These are the roles and controls that decide what happens once they are there.
Continuity
The Super Admin acts as a backup to the Org Admin, for the day that person is unexpectedly absent or leaves. Administrative access does not walk out of the building with one individual.
Compliance
The Super Admin participates automatically in every conversation the organization has pre-authorized, so oversight does not depend on someone remembering to add an observer.
Control
The Super Admin enforces group and conversation policies, and can adjust Group Admins and Managers when that is warranted.
Created with the organization, and set up before anything else
The Super Admin account is created when the organization is. The organization then has to set its credentials and a forwarding email address, and that setup is mandatory rather than optional: an agreement addendum, plus a password and a passphrase, before the organization can go further.
Sessions, by device, endable from one screen
An administrator can see a user's active Buzz sessions listed by device, an iPad, an iPhone, WeBuzz in a desktop browser, each with the time it was last used, and can sign that user out of every device at once. Auditing a user's activity in more detail requires the organization's admin settings to permit it.
Safety and data
Identity is the control surface.
Single sign-on only helps if the leaving half works as well as the joining half.
Questions agencies ask
Which identity providers does it work with?
Buzz signs users in over SAML from an enterprise identity provider. Microsoft Entra ID, which is the directory formerly called Azure AD, along with Okta and Ping.
Does Buzz ever see our passwords?
No. Credentials are entered only on your organization's login page. What comes back to Buzz is a signed assertion from your identity provider saying the sign-in succeeded. Buzz does not store the password and does not see it.
Do our multi-factor and conditional access policies still apply?
Yes. They are enforced by your identity provider rather than by Buzz, so whatever your organization already requires of a sign-in continues to apply before anyone reaches Buzz.
How does a brand new employee get a Buzz account?
Just-in-time provisioning: a user who has not signed in to Buzz before can be provisioned at their first successful sign-in, rather than created in advance.
Can our staff share one Buzz login?
No. HIPAA requires unique user identification, so every person needs their own account. Single sign-on is what makes that practical rather than painful.
What happens when someone leaves?
An organization administrator removes them. A member only sees organization messages while they belong to the organization, and leaving removes access to the linked groups. An administrator can also end every active session for that user from one screen.
If we disable someone in our directory, does their Buzz access end automatically?
Organization administrators remove users in Buzz, and an administrator can end every active session for that user from one screen. Bring your directory to the demo and we will walk the leave from start to finish.
Is SCIM provisioning available?
Buzz provisions a new user at their first successful single sign-on, and organization administrators add and remove users directly. We can walk your provisioning setup in the demo.
Do you support Google Workspace?
BuzzPassport signs users in over SAML from Microsoft Entra ID, Okta and Ping. Bring the identity provider you run to the demo and we will go through it.
What do the Outlook and Power Automate connections actually do?
BuzzPassport connects Buzz to Outlook and Power Automate under the same organizational sign-in. It was built for Andwell's referral workflow, where a referral arriving in the mailbox reaches the care team. The demo walks the flow.
Next step
Bring your directory. We will show you the join and the leave.
The useful demo is not the sign-in, it is what happens to an account on the day someone starts and the day someone goes. Book a demo and we will walk both.
BuzzPassport is part of the Buzz platform, alongside BuzzStreams, BuzzChat and BuzzFlow.