Directory sync
Point an identity provider at penv over SCIM so it provisions and deprovisions members, and what a closed seat does to billing.
Path: Settings > Single Sign-On > Directory sync (/settings/sso/directory). SCIM, on Enterprise, or on Pro with the directory sync add-on. Protocol: RFC 7644.
Fields
| Field | Content |
|---|---|
| Base URL | The address your identity provider posts to |
| Tokens | Bearer tokens your provider presents, shown once at mint time. Replace a lost token; we never recover it |
| State | Running or paused, and the last request time. Pausing stops us acting on requests but keeps the connection |
Provisioning
| Rule | Effect |
|---|---|
| Address | Must be on a domain this workspace has verified. Any other address is refused with a 400 and creates nothing |
| New person | We create their account without marking the address verified. They prove it the first time they sign in: with a code, a provider, or your single sign-on |
| Existing account | Gains a membership in your workspace, on a verified domain only. We never read their account name back to your provider |
| Seats | If your workspace has no seat left, we refuse with a 403 and write nothing. A person your provider sends inactive takes no seat |
Deprovisioning
| Event | Effect |
|---|---|
| Provider sets a person inactive | We mark the membership, not delete it; the row still answers a SCIM read |
| Access | Ends on the person's next request |
| Sessions | We revoke live sessions pointing at this workspace |
| Grants | We drop every grant in this workspace, at any scope |
| Account | Untouched (shared across workspaces) |
| Seat | Stops counting toward your seats (plan limits) |
| Provider reactivates the person | We restore the membership, if a seat is free |
| Provider names a role this workspace lacks | We skip it, never guess |
Required permissions
Slugs: roles and permissions. Pausing and revoking never need the plan, so a lapse cannot strand your token. Step-up rules: Security and two-factor.
| Action | Needs | Step-up | Enterprise or add-on |
|---|---|---|---|
| Read the page | sso:read | No | No |
| Set up directory sync | sso:manage | Two-factor and fresh | Yes |
| Mint a token | sso:manage | Two-factor and fresh | Yes |
| Revoke a token | sso:manage | Yes | No |
| Resume sync | sso:manage | Two-factor and fresh | Yes |
| Pause sync | sso:manage | Two-factor and fresh | No |
Audit entries
| Entry | Meaning |
|---|---|
member.provisioned | Your directory created a member |
member.updated | Your directory changed a member |
member.deprovisioned | Your directory closed a seat |
member.reprovisioned | Your directory reopened a seat |
org.scim_role_skipped | Your directory named a role this workspace lacks |
Next: security and MFA.
Single sign-on
Console reference for single sign-on: domain verification, the provider connection, claim-to-role mapping, the sign-in requirement, and plan gating.
Security and two-factor
Console reference for personal sign-in credentials, step-up confirmation, and the workspace-wide two-factor requirement.