Connect single sign-on (SAML) and SCIM provisioning

Let people sign in with Okta, Microsoft Entra ID or Google, and add or remove them automatically.

Steps

1. 1

   Open Admin console › Security › Sign-in & SSO (Business plan).

2. 2

   Verify your company domain by adding the DNS TXT record shown on the screen.

3. 3

   Paste your identity provider's SAML metadata URL and save. Test sign-in with one account before you require SSO for everyone.

4. 4

   Create a SCIM token and add it, with the SCIM URL, to your identity provider to provision people and groups.

5. 5

   Map each SCIM group to a vault so membership follows your directory. Removing someone revokes their access and flags shared vaults for key rotation.