Let your provider manage the roster
Point your identity provider at penv so it adds and removes people for you, and see what closing a seat does to the bill.
Your identity provider adds and removes people for you. /settings/sso/directory is where you point it at penv. The precise term for this is SCIM directory sync, and your provider will call it that.
What the page shows
| Thing | What it is for |
|---|---|
| Base URL | The address your provider posts to |
| Tokens | The bearer tokens it presents, each shown once at mint time |
| State | Whether sync is running or paused, and when the last request arrived |
A token is shown one time. Losing one means minting another rather than recovering it.
Pausing sync stops penv acting on what the provider sends without taking the connection down.
What a closed seat does
A directory setting somebody to inactive marks the membership rather than deleting the row. Your provider never issues a delete, and the row still has to answer a read afterward.
What ends is access, on that person's next request. Their live sessions pointing at this workspace are revoked, and every grant they held here is dropped at any scope. Their account is untouched, because it is shared with the other workspaces they belong to.
The seat count is active memberships, so a seat closed by the directory stops costing you.
Reactivating somebody in your directory restores the membership. The entry for that is member.reprovisioned.
A role the directory names that is not this workspace's is skipped rather than guessed at, and that lands org.scim_role_skipped.
Plan
Directory sync is Enterprise, alongside the connection itself. Setting it up and minting a token both need the plan. Pausing sync and revoking a token never do, so a lapsed plan cannot leave a token you cannot revoke.
What each action needs
| Action | Needs | Confirm it is you | Also needs Enterprise |
|---|---|---|---|
| Read the page | sso:read | No | No |
| Set up directory sync | sso:manage | Yes | Yes |
| Mint a token | sso:manage | Yes | Yes |
| Revoke a token | sso:manage | Yes | No |
| Resume sync | sso:manage | Yes | Yes |
| Pause sync | sso:manage | Yes | No |
What the directory writes to the record
| Entry | What happened |
|---|---|
member.provisioned | The directory created a member |
member.updated | It changed one |
member.deprovisioned | It closed a seat |
member.reprovisioned | It reopened one |
org.scim_role_skipped | It named a role this workspace does not have |