Docs
Referencesince cloud@2026-09-10

Let your provider manage the roster

Point your identity provider at penv so it adds and removes people for you, and see what closing a seat does to the bill.

Your identity provider adds and removes people for you. /settings/sso/directory is where you point it at penv. The precise term for this is SCIM directory sync, and your provider will call it that.

What the page shows

ThingWhat it is for
Base URLThe address your provider posts to
TokensThe bearer tokens it presents, each shown once at mint time
StateWhether sync is running or paused, and when the last request arrived

A token is shown one time. Losing one means minting another rather than recovering it.

Pausing sync stops penv acting on what the provider sends without taking the connection down.

What a closed seat does

A directory setting somebody to inactive marks the membership rather than deleting the row. Your provider never issues a delete, and the row still has to answer a read afterward.

What ends is access, on that person's next request. Their live sessions pointing at this workspace are revoked, and every grant they held here is dropped at any scope. Their account is untouched, because it is shared with the other workspaces they belong to.

The seat count is active memberships, so a seat closed by the directory stops costing you.

Reactivating somebody in your directory restores the membership. The entry for that is member.reprovisioned.

A role the directory names that is not this workspace's is skipped rather than guessed at, and that lands org.scim_role_skipped.

Plan

Directory sync is Enterprise, alongside the connection itself. Setting it up and minting a token both need the plan. Pausing sync and revoking a token never do, so a lapsed plan cannot leave a token you cannot revoke.

What each action needs

ActionNeedsConfirm it is youAlso needs Enterprise
Read the pagesso:readNoNo
Set up directory syncsso:manageYesYes
Mint a tokensso:manageYesYes
Revoke a tokensso:manageYesNo
Resume syncsso:manageYesYes
Pause syncsso:manageYesNo

What the directory writes to the record

EntryWhat happened
member.provisionedThe directory created a member
member.updatedIt changed one
member.deprovisionedIt closed a seat
member.reprovisionedIt reopened one
org.scim_role_skippedIt named a role this workspace does not have

Next: two-factor and how you sign in.