Take a look at this KB article and then change the end user message to Allow Message (Select Reason). 

https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0017027

You can also use the QS policy for mac as a guide.

https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0018815

Hi Howard,

Trust you are doing well. We are facing one issue on password safe. Below is the topic i have created .

Can you please review and suggest in any solution . I have raised case with BT as well(CS1417515 ) However Support engineer is not sure if we can change the URL when users session expires due to idle session timeout.

I request you to please review and let me know if this can be achieved .

Thanks in advance.

Regards,

Imran