Azul Tech SSO Deployed Across Every Company Application

Azul Tech now runs a single identity system for the whole company. One account per person, one login, used by every internal application. It started with one small internal app and extended outward until nothing was left outside it.

The system is built on Keycloak and runs on Azul Tech's own servers, so passwords and identities are never held by an outside service.

Accounts are created from the staff list. Each person receives a one-time link, sets a password nobody else ever knows, and enrols an authenticator app. Two-factor authentication is required for everyone, with no exceptions and no opt-out.

Signing in means a password plus a six-digit code from a phone. A forgotten password is handled by a self-service reset link. A lost phone is handled by identity verification, a two-factor reset, and a fresh setup link.

When someone leaves, an administrator disables the one account and their access to every application ends at the same moment.

An organisation without single sign-on does not have an access problem, it has an arithmetic problem. Ten applications and forty staff is four hundred separate credentials, each one created by hand, forgotten separately, and revoked separately.

Offboarding is where that arithmetic becomes dangerous. Someone leaves, four or five accounts get disabled, and the rest stay open because nobody has the full list. The risk is not that people are careless. It is that no human can hold the whole picture.

One password to remember instead of ten, and one you can make genuinely strong because it is the only one.

No new account to create when a new internal tool appears. It already knows who you are the first time you open it.

If your phone is lost or stolen, one reset restores your access everywhere rather than a day of separate recovery flows.