Who this article is for: Authority Users.
Overview
Single sign-on (SSO) lets you log in to SwiftComply Stormwater with your organization's work account instead of a separate SwiftComply username and password. Stormwater supports two SSO providers: Microsoft Entra ID (your Microsoft work account) and Okta.
SSO is set up for each organization separately by the SwiftComply team, and an organization uses one provider at a time. If your organization doesn't have SSO set up, the login page shows only the username and password fields. This article covers what you see when you log in after SSO is set up.
Before You Begin
The SwiftComply team has set up SSO for your organization.
You can sign in to your organization's Microsoft or Okta work account.
Logging In on the Web
Go to your organization's Stormwater login page.
Below the username and password fields, click LOGIN WITH MICROSOFT ENTRA ID or LOGIN WITH OKTA. The button names the provider your organization uses.
You're taken to your provider's sign-in page. Sign in with your work account. Any security checks your organization adds, such as a Microsoft verification prompt, happen on this page.
You're returned to Stormwater and logged in.
đ If your organization requires multi-factor authentication in Stormwater, you may see an access code step after you return. Stormwater shows A new access code has been sent to your email. Please enter the code to complete the login process. Enter the code from your email in Access Code and click Continue. Whether you get this step depends on how SSO is set up for your organization. See the FAQ below.
Logging In on the Mobile App
On the app's login screen, tap Login with SSO.
Enter your organization's name in the Enter your Organization Name field, then tap Continue.
Sign in with your work account on your provider's sign-in page.
You're returned to the app and logged in.
FAQ
Q: Can I still log in with a username and password?
A: The login page shows the username and password fields next to the SSO button, but a password works only for accounts that aren't linked to SSO. Once your account is linked to Microsoft or Okta, you log in through the provider's button.
Q: Is my account created automatically the first time I log in?
A: It depends on the provider. With Okta, Stormwater creates a new account the first time someone signs in with an Okta login it hasn't seen before, using the name and email from Okta. It doesn't match on email, so if that person already has a Stormwater account, they'll end up with a second one. A new Okta account starts as a View Only, Restricted User with no tags, so it sees no sites until an administrator updates its access. With Microsoft Entra ID, Stormwater creates new accounts only if SwiftComply has turned on automatic account creation for your organization. Their access level comes from the Entra groups SwiftComply has mapped for your organization. Anyone outside those groups gets your organization's default level, or Restricted User with no tags if there is no default. If your organization's Microsoft setup doesn't share group membership with Stormwater, every new account starts as a Restricted User with no tags. Stormwater doesn't create administrator accounts automatically with either provider.
Q: I logged in with Microsoft and saw "No matching account" instead of Stormwater.
A: The full message is No matching account for this Entra identity. Provisioning is required. It means Stormwater found no account linked to your Microsoft identity and didn't create one. Contact your SwiftComply representative or email help@swiftcomply.com, and include the time you tried to log in.
Q: My organization is moving from Okta to Microsoft. Do I need a new account?
A: No. The SwiftComply team opens a set period for the move with your organization. During it, your first Microsoft login links your existing Stormwater account, so you keep the same records and access. After the move, the login page shows LOGIN WITH MICROSOFT ENTRA ID instead of LOGIN WITH OKTA.
Q: Why do I still get an emailed access code after logging in with Microsoft?
A: If your organization requires multi-factor authentication in Stormwater, the emailed code is skipped for an SSO login in two cases. Either Microsoft confirms it verified you with multi-factor authentication during that login, or your organization has chosen to rely on its provider's own verification for every SSO login. Otherwise, Stormwater emails a code. To change this, contact your SwiftComply representative.
Q: I see a Microsoft error page before I get back to Stormwater.
A: That page comes from your organization's Microsoft sign-in, before Stormwater receives the login. Your organization's IT team manages those settings. Share the details shown on the error page with them.
Q: Why can't an administrator change my name or email in Stormwater?
A: For an account that logs in with Microsoft or Okta, Stormwater doesn't save changes to the first name, last name, email, username, or password made on the user's edit screen. Those details come from your organization's identity provider.
Q: I'm a deactivated user. Can I still log in with SSO?
A: No. A deactivated account can't log in through SSO. Stormwater shows User account is not active. Please contact site administrator. (Microsoft) or User has been disabled. Please contact site administrator. (Okta). An administrator must reactivate your account first.
Q: How do I set up SSO for my organization?
A: The SwiftComply team sets up SSO. Contact your SwiftComply representative to request it. Setup also needs your organization's IT team to register Stormwater with your provider.