Customer onboarding

This guide walks through everything needed to bring a new customer organization live on Bond Trials - from creating their workspace to connecting their identity provider and handing off to their team lead. The process takes about 15 minutes once you have the customer's IdP credentials.

Create the organization

Every customer gets their own organization - an isolated workspace with its own trials, patients, storage, and members. No data crosses org boundaries. Organizations are created by Bond staff in the developer console; customers cannot self-create one.

1. 1

   Open the admin console

   Go to admin.bondtrials.com (staff-only, behind Cloudflare Access) and open the Organizations tab.
2. 2

   Create organization

   Click New organization, enter the customer's full legal name and select their preferred AWS region for data residency. The slug is generated for you. Optionally add an owner email - they get an Org Admin invite - and/or set up SSO in the same step.
3. 3

   Confirm it was created

   The new organization appears in the console's org list right away. The customer's team then manages their own members and teams from the Organization view on the platform.

SSO - Azure AD (Microsoft Entra)

Follow these steps if the customer uses Microsoft 365 / Azure AD.

1. 1

   Register an app in Azure Portal

   Go to portal.azure.com → App registrations → New registration. Name it Bond Trials. Set supported account types to Accounts in any organizational directory. Add the redirect URI: https://platform.bondtrials.com/api/auth/callback/microsoft-entra-id
2. 2

   Add a client secret

   Certificates & secrets → New client secret. Copy the Value immediately - it only shows once.
3. 3

   Collect credentials

   From the app Overview tab: Application (client) ID and Directory (tenant) ID. Together with the secret, these are the three values you need.
4. 4

   Add the app secrets

   Add AZURE_AD_CLIENT_ID and AZURE_AD_CLIENT_SECRET to the app-env secret in AWS Secrets Manager, then roll the service. Leave AZURE_AD_TENANT_ID unset - Bond defaults to common, which supports all tenants.

SSO - Okta

Follow these steps if the customer uses Okta.

1. 1

   Create an app integration in Okta

   Applications → Create App Integration → OIDC → Web Application. Set the sign-in redirect URI to: https://platform.bondtrials.com/api/auth/callback/okta
2. 2

   Collect credentials

   From the app's General tab: Client ID and Client Secret. From the Okta dashboard top-right: Okta domain (e.g. acme.okta.com).
3. 3

   Add the app secrets

   Add OKTA_CLIENT_ID, OKTA_CLIENT_SECRET, and OKTA_ISSUER (the full domain with https://) to the app-env secret in AWS Secrets Manager, then roll the service.

Link SSO to the org

Once the IdP app is created, link the customer's tenant to their Bond org so that users who sign in via SSO land in the right workspace automatically.

1. 1

   Open the customer's org in Organization view

   Switch to their org using the org switcher, then go to Organization.
2. 2

   Scroll to SSO Tenant Mappings

   The panel appears at the bottom of the org detail view, visible to org owners only.
3. 3

   Add a mapping

   Click Add mapping, select the provider (Microsoft or Okta), paste the tenant identifier (Azure tenant GUID or Okta domain), and set the default role.
4. 4

   Save

   Takes effect immediately - no redeploy needed.

Test sign-in

Once the tenant mapping is in place, any user the customer's IT team grants access to in Azure AD or Okta can sign straight into Bond - no invite needed. Bond provisions them into the correct organization automatically on first login.

1. 1

   Ask the team lead to go to the login page

   They click the Microsoft or Okta button and sign in with their corporate credentials.
2. 2

   Bond provisions them automatically

   Their tenant is matched to the org via the mapping. They land in the right workspace with the configured default role.
3. 3

   Their IT team controls access from here

   Anyone the customer's IT team grants access to in Azure/Okta can sign in. No further action needed from Bond.

Handoff checklist

Before marking the customer as live, confirm the following:

• Organization created with the correct name, slug, and AWS region.
• SSO secrets set in AWS Secrets Manager and the service has been rolled.
• SsoTenantMapping row exists with the correct provider, tenant ID, and org ID.
• At least one org admin has successfully signed in via SSO.
• That admin can see their organization in the org switcher.
• A test trial can be created and saved without errors.
• EHR credentials configured if the customer has a connected system.