Identity and access

the platform separates authentication from user provisioning. Invite and role-manage members in the organization, use SAML single sign-on (SSO) to authenticate them through your identity provider, and use SCIM to create, update, and deactivate their access.

Roles and permissions Choose roles and decide whether to manage them in the platform or via SAML

Single sign-on Configure SAML authentication, verify domains, and optionally map roles

SCIM provisioning Automate user provisioning and deprovisioning from your identity provider

Audit log Investigate who changed people, roles, and organization records

How the capabilities work together

SSO verifies a member’s identity when they sign in, but it does not create or remove organization memberships. SCIM manages those memberships and user records, but it does not authenticate users. Organizations commonly configure both against the same identity provider so that assignment controls access and SSO protects authentication.

flowchart TB
  idp["Identity provider"]
  sso["SAML SSO<br/>authenticates"]
  scim["SCIM<br/>provisions and deactivates"]
  profile["Profile and membership"]
  signin["Sign-in allowed"]
  permitted["What the person can do"]

  idp --> sso
  idp --> scim
  scim --> profile
  sso --> signin
  profile --> signin
  profile --> permitted

SSO authenticates, SCIM provisions, and the membership role decides what is permitted.

Recommended rollout

1. Invite initial owners and administrators under Roles and permissions.
2. Verify the email domain used by organization members.
3. Configure SSO as optional and test both service-provider and identity-provider initiated sign-in.
4. Configure SCIM with a limited group and confirm provisioning, updates, and deprovisioning.
5. Expand the SCIM assignment to the intended population.
6. Require SSO only after confirming that expected members can sign in and that a recovery path is available.

the platform provides setup guides for Google Workspace, Microsoft Entra ID or Microsoft 365, and Okta under the SSO and SCIM sections.

Role management choices

Keep membership roles in People, or map them from your identity provider with the SAML Role Attribute. SCIM creates and deactivates people and usually starts them as Employee; set their the platform role in People afterward. See Where to manage the platform roles.