SSO & SCIM
Enterprise organizations can connect their identity provider (IdP) for SAML single sign-on and SCIM provisioning — members sign in with your company IdP, and users are auto-provisioned and deprovisioned as your directory changes. Both are configured from the organization console → Settings → SSO / SCIM, are admin/owner only, and require the Enterprise plan (the Hub returns a plan-required notice otherwise).
SAML single sign-on
Wire your IdP as the trust anchor so org members authenticate through it.
Configure the IdP side (Settings → SSO):
| Field | Meaning |
|---|---|
| IdP Entity ID (Issuer) | Your IdP's issuer identifier. |
| IdP SSO URL | The IdP's SAML SSO endpoint (must be HTTPS). |
| IdP signing certificate (PEM) | The cert used to verify SAML assertions. Re-paste to change; not shown back for security. |
| Default role for new members | Role JIT-provisioned users receive — member or viewer. |
| Auto-provision on first login (JIT) | Create a member automatically the first time they sign in. |
Once saved, the console shows the certificate's SHA-256 fingerprint and lets you enable / disable SSO without deleting the config.
Give the SP side to your IdP (the console's Service provider details card):
- SP metadata URL — public; returns the SP metadata XML most IdPs can import directly.
- SP Entity ID (Audience) and ACS URL (Assertion Consumer Service / reply URL).
Entity ID, SSO URL, and signing certificate are all required; the SSO URL must be a valid HTTPS URL, and the certificate must parse.
SCIM provisioning
SCIM lets your IdP auto-provision and deprovision org members over the standard SCIM protocol, keyed by a SCIM bearer token.
- Mint a token (Settings → SCIM), optionally labelled (e.g. "Okta production"). The token is shown once — copy it and paste it into your IdP's SCIM connector as the bearer token; it is never shown again.
- Your IdP then creates, updates, and deactivates members automatically.
- Revoke a token to immediately stop that IdP from provisioning.
Group → role mapping
Map an IdP group's display name to an org role so directory groups drive org
roles: members of a mapped group receive that role (highest role wins;
owner can't be assigned this way). Removing a mapping recomputes the affected
members.
Group→role mapping depends on a newer Hub capability. On a server that predates it, the console shows a "not available on this server yet" notice for that section only — SCIM token provisioning still works.
Roles
admin and member roles can be granted through SSO JIT (default role) and SCIM
group mapping; viewer is also assignable. Owner is never auto-assigned by
SSO or SCIM — ownership is managed explicitly in the console.
Related
- Orgs overview — members, roles, and the console
- Org agents & tokens — enrollment tokens and org API keys
- Billing & spend — the shared wallet and spend caps